Close Open Privacy Scan

link https://github.com/mckaywrigley/chatbot-ui
bolt Snapshot: commit 81328b6
science engine v1.21
schedule 2026-07-19T01:12:48.759839+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code. Dependency data flows are listed separately and do not affect this verdict.

smart_toy AI deps detected: @anthropic-ai/sdk, @google/generative-ai, @mistralai/mistralai, ai +2 more — detected in dependencies, not a safety judgment.

App Privacy Score

82 /100
Low privacy risk

Low risk · 1197 finding(s)

Dependency score: 22 (High risk)

bar_chart Score Breakdown

egress −15
env_fs −3

list Scan Summary

0 high 111 medium 1086 low
First-party packages: 2
Dependency packages: 28
Ecosystem: npm

swap_horiz Application data flows

No application data flows were found. See dependency data flows below.

hub Dependency data flows (111)
medium ai dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/[email protected]/src/realtime/realtime-session.ts:110 → pkgs/npm/[email protected]/src/realtime/realtime-session.ts:110
medium openai dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/[email protected]/auth/workload-identity-auth.js:46 → pkgs/npm/[email protected]/auth/workload-identity-auth.js:53
medium openai dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/[email protected]/auth/workload-identity-auth.mjs:42 → pkgs/npm/[email protected]/auth/workload-identity-auth.mjs:49
medium openai dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/[email protected]/src/auth/workload-identity-auth.ts:60 → pkgs/npm/[email protected]/src/auth/workload-identity-auth.ts:69
medium @anthropic-ai/sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/oidc-federation.js:39 → pkgs/npm/@[email protected]/lib/credentials/oidc-federation.js:42
medium @anthropic-ai/sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/oidc-federation.mjs:36 → pkgs/npm/@[email protected]/lib/credentials/oidc-federation.mjs:39
medium @anthropic-ai/sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:91 → pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:94
medium @anthropic-ai/sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:55 → pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:58
medium @anthropic-ai/sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/src/lib/credentials/oidc-federation.ts:80 → pkgs/npm/@[email protected]/src/lib/credentials/oidc-federation.ts:83
medium @anthropic-ai/sdk dependency A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:92 → pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:95
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:30
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:42
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:45
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:51
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:53
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:59
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_chat_no_streaming.ts:3 → pkgs/npm/@[email protected]/examples/src/async_chat_no_streaming.ts:15
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_chat_prediction.ts:3 → pkgs/npm/@[email protected]/examples/src/async_chat_prediction.ts:33
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_chat_with_image_no_streaming.ts:3 → pkgs/npm/@[email protected]/examples/src/async_chat_with_image_no_streaming.ts:27
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_embeddings.ts:3 → pkgs/npm/@[email protected]/examples/src/async_embeddings.ts:20
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_files.ts:6 → pkgs/npm/@[email protected]/examples/src/async_files.ts:24
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_files.ts:6 → pkgs/npm/@[email protected]/examples/src/async_files.ts:28
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_files.ts:6 → pkgs/npm/@[email protected]/examples/src/async_files.ts:32
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_files.ts:6 → pkgs/npm/@[email protected]/examples/src/async_files.ts:36
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4 → pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:127
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4 → pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:128
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4 → pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:147
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:3 → pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:150
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:3 → pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:151
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_json_format.ts:3 → pkgs/npm/@[email protected]/examples/src/async_json_format.ts:16
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:6 → pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:33
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_url.ts:3 → pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_url.ts:15
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:4 → pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:52
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:4 → pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:70
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:3 → pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:27
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:3 → pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:23
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:3 → pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:38
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:107 → pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:153
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:162 → pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:213
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning.ts:3 → pkgs/npm/@[email protected]/examples/src/reasoning.ts:35
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning.ts:3 → pkgs/npm/@[email protected]/examples/src/reasoning.ts:42
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning.ts:3 → pkgs/npm/@[email protected]/examples/src/reasoning.ts:47
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:14 → pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:61
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:14 → pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:74
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:7 → pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:30
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:7 → pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:32
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3 → pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:30
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3 → pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:47
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3 → pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:50
medium @mistralai/mistralai tooling PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/packages/mistralai-azure/examples/chatComplete.example.ts:18 → pkgs/npm/@[email protected]/packages/mistralai-azure/examples/chatComplete.example.ts:35
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/api_version.js:26 → pkgs/npm/@[email protected]__reposrc/samples/api_version.js:33
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:34 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:58
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:34 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:65
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:134
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:138
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:151
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:192 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:216
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:225 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:251
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:261 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:284
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:261 → pkgs/npm/@[email protected]__reposrc/samples/cache.js:291
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/chat.js:30 → pkgs/npm/@[email protected]__reposrc/samples/chat.js:45
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/chat.js:30 → pkgs/npm/@[email protected]__reposrc/samples/chat.js:47
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:24 → pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:36
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:44 → pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:66
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:74 → pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:87
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:27 → pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:56
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:64 → pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:76
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:45
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:55
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:86
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:96
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:132
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:140
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:178
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:186
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:242
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:250
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:302
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:311
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:335
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:349
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:368
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358 → pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:388
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/embed.js:24 → pkgs/npm/@[email protected]__reposrc/samples/embed.js:31
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/embed.js:39 → pkgs/npm/@[email protected]__reposrc/samples/embed.js:56
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:31 → pkgs/npm/@[email protected]__reposrc/samples/files.js:41
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:31 → pkgs/npm/@[email protected]__reposrc/samples/files.js:69
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:78 → pkgs/npm/@[email protected]__reposrc/samples/files.js:102
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:78 → pkgs/npm/@[email protected]__reposrc/samples/files.js:117
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:126 → pkgs/npm/@[email protected]__reposrc/samples/files.js:133
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:126 → pkgs/npm/@[email protected]__reposrc/samples/files.js:161
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:170 → pkgs/npm/@[email protected]__reposrc/samples/files.js:194
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:170 → pkgs/npm/@[email protected]__reposrc/samples/files.js:209
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:222 → pkgs/npm/@[email protected]__reposrc/samples/files.js:239
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:220 → pkgs/npm/@[email protected]__reposrc/samples/files.js:267
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:275 → pkgs/npm/@[email protected]__reposrc/samples/files.js:281
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:290 → pkgs/npm/@[email protected]__reposrc/samples/files.js:304
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:314 → pkgs/npm/@[email protected]__reposrc/samples/files.js:327
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:61 → pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:93
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:24 → pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:37
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:24 → pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:38
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:28 → pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:50
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:59 → pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:85
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:31 → pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:50
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:61 → pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:75
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:24 → pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:35
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:31 → pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:37
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:64 → pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:84
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:125 → pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:149
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:194 → pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:214
medium @google/generative-ai dependency PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:223 → pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:255

</> First-Party Code

first-party (npm)

npm first-party
expand_more 49 low-confidence finding(s)
low egress production #261dd1b0cf585ae5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/app/[locale]/[workspaceid]/layout.tsx:108 
        const response = await fetch(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #7343e7c7bcfd19e4 — Environment-variable access.
repo/app/[locale]/layout.tsx:75 
    process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #79dcce3e3ff01cee — Environment-variable access.
repo/app/[locale]/layout.tsx:76 
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #4e666027e801a368 — Environment-variable access.
repo/app/[locale]/login/page.tsx:24 
    process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #e281383952eaf628 — Environment-variable access.
repo/app/[locale]/login/page.tsx:25 
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #87e68a7fbaec1be3 — Environment-variable access.
repo/app/[locale]/login/page.tsx:86 
    if (process.env.EDGE_CONFIG) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c2833bffcfa1eda0 — Environment-variable access.
repo/app/[locale]/login/page.tsx:90 
    return process.env[name]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ed1d658dafb70f38 — Environment-variable access.
repo/app/api/chat/custom/route.ts:21 
      process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #778fbf0c20f3a0f9 — Environment-variable access.
repo/app/api/chat/custom/route.ts:22 
      process.env.SUPABASE_SERVICE_ROLE_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #79be6a08d1d18015 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/app/api/chat/tools/route.ts:153 
          const response = await fetch(fullUrl, requestInit)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #141971a0669d11f5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/app/api/chat/tools/route.ts:178 
          const response = await fetch(fullUrl, {
            method: "GET",
            headers: headers
          })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #e73d2ebbda267ea9 — Environment-variable access.
repo/app/api/retrieval/process/docx/route.ts:21 
      process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #f536069b5cc8a911 — Environment-variable access.
repo/app/api/retrieval/process/docx/route.ts:22 
      process.env.SUPABASE_SERVICE_ROLE_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #1201801e61f4eccc — Environment-variable access.
repo/app/api/retrieval/process/route.ts:19 
      process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #11508a2dbaba2f6f — Environment-variable access.
repo/app/api/retrieval/process/route.ts:20 
      process.env.SUPABASE_SERVICE_ROLE_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #0affc5e4f6a34b36 — Environment-variable access.
repo/app/api/retrieval/retrieve/route.ts:20 
      process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #df4729daaeb7a6ec — Environment-variable access.
repo/app/api/retrieval/retrieve/route.ts:21 
      process.env.SUPABASE_SERVICE_ROLE_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #ea0091be8da91dae — Environment-variable access.
repo/app/api/username/available/route.ts:14 
      process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #45306c238e44e24d — Environment-variable access.
repo/app/api/username/available/route.ts:15 
      process.env.SUPABASE_SERVICE_ROLE_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #030d8f7b8373ccb8 — Environment-variable access.
repo/app/api/username/get/route.ts:14 
      process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #465b5497f8f819c4 — Environment-variable access.
repo/app/api/username/get/route.ts:15 
      process.env.SUPABASE_SERVICE_ROLE_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #be905d7ede451c0d — Environment-variable access.
repo/components/chat/chat-helpers/index.ts:163 
    process.env.NEXT_PUBLIC_OLLAMA_URL + "/api/chat",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #2483cbbc04755031 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/components/chat/chat-helpers/index.ts:257 
  const response = await fetch(url, {
    method: "POST",
    body: JSON.stringify(body),
    signal: controller.signal
  })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #785a86e3d86a76f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/components/chat/chat-ui.tsx:89 
                const response = await fetch(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #36bf77f76035f284 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/components/sidebar/items/all/sidebar-create-item.tsx:132 
          const response = await fetch(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #a22c4adfaaacb0e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/components/sidebar/items/all/sidebar-update-item.tsx:517 
          const response = await fetch(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress production #ed029b1f83fa673a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/components/utility/drawing-canvas.tsx:73 
      fetch(dataURL)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #245706bbf2f808bd — Environment-variable access.
repo/components/utility/global-state.tsx:147 
      if (process.env.NEXT_PUBLIC_OLLAMA_URL) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #47b668e2d87034cb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/components/utility/global-state.tsx:180 
          const response = await fetch(workspaceImageUrl)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #a765f4f9f089b198 — Environment-variable access.
repo/components/utility/profile-settings.tsx:618 
                              !!process.env.NEXT_PUBLIC_OPENAI_ORGANIZATION_ID

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #265e644f572db51d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/components/workspace/workspace-settings.tsx:89 
        const response = await fetch(url)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #42f9b87e0cc50d2d — Environment-variable access.
repo/db/storage/files.ts:13 
    process.env.NEXT_PUBLIC_USER_FILE_SIZE_LIMIT || "10000000"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #965abae750a3e39b — Environment-variable access.
repo/lib/envs.ts:5 
  return Boolean(process.env[type])

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #3cbea95fce9bf167 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
repo/lib/models/fetch-models.ts:57 
    const response = await fetch(
      process.env.NEXT_PUBLIC_OLLAMA_URL + "/api/tags"
    )

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #2cbb80a0111e4567 — Environment-variable access.
repo/lib/models/fetch-models.ts:58 
      process.env.NEXT_PUBLIC_OLLAMA_URL + "/api/tags"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress production #fe0bd591f7b7776b — Hardcoded external endpoint. Review what data is sent to this destination.
repo/lib/models/fetch-models.ts:84 
    const response = await fetch("https://openrouter.ai/api/v1/models")

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs production #939ec71162dcc00b — Environment-variable access.
repo/lib/server/server-chat-helpers.ts:9 
    process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c06765802648b03b — Environment-variable access.
repo/lib/server/server-chat-helpers.ts:10 
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2f033fa201ad0402 — Environment-variable access.
repo/lib/server/server-chat-helpers.ts:61 
    if (process.env[envKey]) {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #fed08937abd7c302 — Environment-variable access.
repo/lib/server/server-chat-helpers.ts:62 
      ;(profile as any)[profileKey] = process.env[envKey]

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #2befacafe60b0b14 — Environment-variable access.
repo/lib/supabase/browser-client.ts:5 
  process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #278a3b635698a035 — Environment-variable access.
repo/lib/supabase/browser-client.ts:6 
  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #c1c6cc893c1c7de4 — Environment-variable access.
repo/lib/supabase/client.ts:5 
    process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #cbdcf7a07bc50704 — Environment-variable access.
repo/lib/supabase/client.ts:6 
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #9fb5d507fc13b602 — Environment-variable access.
repo/lib/supabase/middleware.ts:13 
    process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #7d3dc4b7ac64aa23 — Environment-variable access.
repo/lib/supabase/middleware.ts:14 
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #37f5a17fa01b9cc9 — Environment-variable access.
repo/lib/supabase/server.ts:6 
    process.env.NEXT_PUBLIC_SUPABASE_URL!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs production #3c989892150e1937 — Environment-variable access.
repo/lib/supabase/server.ts:7 
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #cde96785c0ba535c — Environment-variable access.
repo/next.config.js:2 
  enabled: process.env.ANALYZE === "true"

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

first-party (npm): __tests__/playwright-test

npm first-party
expand_more 3 low-confidence finding(s)
low env_fs test-only Excluded from app score #db2201ed8bb4a6c7 — Environment-variable access.
repo/__tests__/playwright-test/playwright.config.ts:17 
  forbidOnly: !!process.env.CI,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #f6ea18c8a7039804 — Environment-variable access.
repo/__tests__/playwright-test/playwright.config.ts:19 
  retries: process.env.CI ? 2 : 0,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs test-only Excluded from app score #d5f0bd3192f0c4dc — Environment-variable access.
repo/__tests__/playwright-test/playwright.config.ts:21 
  workers: process.env.CI ? 1 : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

</> Dependencies

@google/generative-ai

npm dependency
medium pii_flow dependency Excluded from app score #60d5adc5b856f7a6 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/api_version.js:33 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/api_version.js:26 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/api_version.js:33 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #953fcb8ae77ec7f4 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:58 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:34 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:58 
  console.log(cacheResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #64bfa6ef2b926850 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:65 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:34 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:65 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #e96f436d7ecf8d57 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:134 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:134 
  console.log(`\n\nmodel: ${result.response.text()}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #a80f8e79b1c3e0c3 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:138 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:138 
  console.log(`\n\nmodel: ${result.response.text()}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #2b72b3d50cc8e382 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:151 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:151 
  console.log(`\n\nmodel: ${result.response.text()}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #6106d04bfe7614fb — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:216 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:192 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:216 
  console.log(cacheGetResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #32bd30d753a42fbd — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:251 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:225 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:251 
    console.log(item);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #4b30cce5f3a90bf6 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:284 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:261 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:284 
  console.log("initial cache data:", cacheResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #c316c534e74fe96e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:291 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:261 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/cache.js:291 
  console.log("updated cache data:", cacheUpdateResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #ffde81af893f31d6 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/chat.js:45 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/chat.js:30 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/chat.js:45 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #9cbcbfebcb981d9a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/chat.js:47 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/chat.js:30 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/chat.js:47 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #b20917df78c40ed4 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:36 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:24 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:36 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #a14dad76e0b115e8 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:66 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:44 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:66 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #fa3f73d322a96b2a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:87 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:74 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:87 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #b81025b96c13ba6e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:56 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:27 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:56 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #020797ca1f99271c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:76 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:64 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:76 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #e98475f58cf1b258 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:45 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:45 
  console.log(countResult.totalTokens); // 11

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #51c43a7628570780 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:55 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:55 
  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #2e3b633bf81df771 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:86 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:86 
  console.log(countResult.totalTokens); // 10

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #0426366cc43ca7ab — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:96 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:96 
  console.log(chatResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #11843b55c7229217 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:132 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:132 
  console.log(countResult.totalTokens); // 265

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #3944ccc5f009a1a5 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:140 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:140 
  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #870b33e6542a4c74 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:178 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:178 
  console.log(countResult.totalTokens); // 265

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #971d5865e0a9176e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:186 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:186 
  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #13e616712ffcfb3a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:242 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:242 
  console.log(countResult.totalTokens); // 302

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #5582c8c44433949f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:250 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:250 
  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #57e90b9aea57d1f5 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:302 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:302 
  console.log(result.totalTokens); // 10

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #3513de7253fde891 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:311 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:311 
  console.log(generateResult.response.usageMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #00dbab0fce8bcd20 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:335 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:335 
  console.log(resultNoInstructions);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #b517b86d89ba0142 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:349 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:349 
  console.log(resultWithInstructions);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #6a40aa18f3fa21e7 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:368 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:368 
  console.log(resultNoTools);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #7c32998be1eaba30 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:388 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:388 
  console.log(resultWithTools);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #480583ffee99dc7a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/embed.js:31 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/embed.js:24 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/embed.js:31 
  console.log(result.embedding);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #abe6dba0ff316792 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/embed.js:56 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/embed.js:39 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/embed.js:56 
  console.log(result.embeddings);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #715181229e806ae8 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:41 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:31 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:41 
  console.log(
    `Uploaded file ${uploadResult.file.displayName} as: ${uploadResult.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #d7f9fc284cf4b66e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:69 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:31 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:69 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #9982a463e526a23f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:102 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:78 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:102 
  console.log(
    `Uploaded file ${uploadResult.file.displayName} as: ${uploadResult.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #9fdd9ec4456644e9 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:117 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:78 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:117 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #1536a6a2298892c7 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:133 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:126 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:133 
  console.log(
    `Uploaded file ${uploadResult.file.displayName} as: ${uploadResult.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #2e72df4a73538216 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:161 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:126 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:161 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #7050a5355de35d55 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:194 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:170 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:194 
  console.log(
    `Uploaded file ${uploadResult.file.displayName} as: ${uploadResult.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #b8d83c4c1a52ce90 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:209 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:170 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:209 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #b0d45165377efe69 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:239 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:222 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:239 
  console.log(
    `Uploaded file ${uploadResponse.file.displayName} as: ${uploadResponse.file.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #b6436c3140bb923b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:267 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:220 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:267 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #500dddd232c3c675 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:281 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:275 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:281 
    console.log(`name: ${file.name} | display name: ${file.displayName}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #cf3aa68b00e4ae38 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:304 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:290 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:304 
  console.log(
    `Retrieved file ${getResponse.displayName} as ${getResponse.uri}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #bfe632337de6b6d5 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/files.js:327 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:314 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/files.js:327 
  console.log(`Deleted ${uploadResult.file.displayName}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #73be8df316c6f05d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:93 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:61 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:93 
    console.log(result2.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #044645dc4033ab8f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:37 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:24 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:37 
    console.log(result.response.candidates[0].logprobsResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #adc6fbe44f99e946 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:38 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:24 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:38 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #dbdf27359b663afb — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:50 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:28 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:50 
    console.log(result.response.candidates[0].safetyRatings);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #6568bd05dd0d3808 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:85 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:59 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:85 
    console.log(result.response.candidates[0].safetyRatings);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #78360312bb921c0b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:50 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:31 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:50 
  console.log(result.response.candidates[0].groundingMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #4ecf7f73a6a6b4d7 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:75 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:61 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:75 
  console.log(result.response.candidates[0].groundingMetadata);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #a72bf4dec83f893d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:35 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:24 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:35 
  console.log(text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #757c53ace599b173 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:37 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:31 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:37 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #5de7816ffbaa1197 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:84 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:64 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:84 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #d3e61213c7bc5d1b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:149 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:125 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:149 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #be0532bca3ff1577 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:214 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:194 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:214 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow dependency Excluded from app score #a6f319f3d6d7bd54 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:255 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:223 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:255 
  console.log(result.response.text());

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 156 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #8932bb6d83be1bff — Filesystem access.
pkgs/npm/@[email protected]__reposrc/rollup.config.mjs:32 
const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "package.json")));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e303b97d1a8dd356 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/api_version.js:26 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d21fa9da2516d62 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:34 
  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b6dcad0df474b06 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:35 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d4728c4808d51cc4 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:60 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b07deb5156e32166 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:75 
  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c0f70d3aff79b71d — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:76 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86e21e8d81ffa013 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:102 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3208c3eb97812dd2 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:114 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #94e651463120b0bd — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:115 
  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a2c9711cc9bb347e — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:116 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba23186a70e12d43 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:161 
  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6278060f0ea6ff1f — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:162 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #734078f40a0b6892 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:192 
  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da27b6ddade8d533 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:193 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb4349eff3325600 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:225 
  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dd1f0e971197f71e — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:226 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8d60ef67f1cb75a3 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:261 
  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #daadcb40eac0ac02 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/cache.js:262 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1a9b10b5db376ef — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/chat.js:19 
import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6f183a85854fd9f5 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/chat.js:30 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d68bd4124306b22 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/chat.js:55 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #95a56959ea236ff6 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/chat.js:86 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fbbc86ac54cf8491 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/chat.js:98 
      data: Buffer.from(fs.readFileSync(`${mediaPath}/jetpack.jpg`)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #19e63a89fd26a774 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:24 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ed7f078c30337094 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:44 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ebcc3807173ac91b — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/code_execution.js:74 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b5c139dddcd6a67 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:27 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c428f89ef95d09ec — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/controlled_generation.js:64 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c1163b19dfe3a42f — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:24 
import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5cdfe489d5575436 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:35 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e4ff68be94a2c288 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:65 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #18fb342f771dc564 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:106 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #75908f5809a613c9 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:114 
        data: Buffer.from(fs.readFileSync(path)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #26a753fd84db1d4b — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:151 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba6b614d831a6b5f — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:165 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #019e0e5744772f37 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:198 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f87ec0aae2d395a3 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:228 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2606135199d29803 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:264 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #56cb0dba38c75f2c — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:270 
  const cacheManager = new GoogleAICacheManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #da1ab2a2c6a9ed4d — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:293 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a31bf18117c9c7bc — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:327 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bce520cc92721904 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/count_tokens.js:358 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a54342160348d0bc — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/embed.js:24 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f598c6fce558a879 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/embed.js:39 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #738779eb5d3ed18b — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/files.js:31 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #7d739f4434a47200 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/files.js:58 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5d6585d4566f7c1a — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/files.js:78 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e75345d3367cdf7 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/files.js:106 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d8890d8e9e7e847 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/files.js:126 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #172d73a0f20e77f3 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/files.js:150 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2c15a58ebabcf1f — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/files.js:170 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0e519f8427072b09 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/files.js:198 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #64b6796bd8394bce — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/files.js:220 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45c40a038f6ef614 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/files.js:222 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1638f4a838a2a831 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/files.js:275 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #99f5b581a3a77e12 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/files.js:290 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #efa9e83a3920a189 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/files.js:314 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bbddbd269d078645 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/function_calling.js:61 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5b36f558c3ed51f8 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/log_prob.js:24 
    const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad9cd1901ecdbc9c — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/model_configuration.js:24 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9fcc6c461ce2a4a3 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:28 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6c8e4137f9aeb8ab — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/safety_settings.js:59 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #711bee458a04089b — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:31 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b8aa9f74d7053896 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/search_grounding.js:61 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e2e2273f36246ff9 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/system_instruction.js:24 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bd28b5320191665c — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:20 
import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2b679936ae06c970 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:31 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #71c04acbda21acef — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:45 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3a77c5cd0ba2faac — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:64 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6dac9937fdf93d83 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:70 
        data: Buffer.from(fs.readFileSync(path)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #57449bccb905b79c — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:92 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cb6861825fb5bfcb — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:98 
        data: Buffer.from(fs.readFileSync(path)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d78b473587d32dd1 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:125 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c20ac7f35d7ce762 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:131 
        data: Buffer.from(fs.readFileSync(path)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81ac317c2194277f — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:157 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0142fecfc4558ed6 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:163 
        data: Buffer.from(fs.readFileSync(path)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6d9a20a0c27ce694 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:194 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f231bfa38e002331 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:200 
        data: Buffer.from(fs.readFileSync(path)).toString("base64"),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #52251ea2d1e6a58d — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:223 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5feb2595d4d1907b — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:226 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2a502838adf03c4c — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:265 
  const genAI = new GoogleGenerativeAI(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3ab82ba230c72226 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/text_generation.js:268 
  const fileManager = new GoogleAIFileManager(process.env.API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b5763da7498e245 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/utils/check-samples.js:19 
import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8a0866af4cc9b2a5 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/utils/check-samples.js:30 
      const file = fs.readFileSync(join(samplesDir, filename), "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #27b8ba79cf57c917 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/utils/insert-import-comments.js:19 
import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ba9764164fc1d681 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/utils/insert-import-comments.js:27 
  const typings = fs.readFileSync(filePath, "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af8b32a7d67e675f — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/utils/insert-import-comments.js:90 
      const file = fs.readFileSync(join(samplesDir, filename), "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c36728df15e22ac9 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/utils/insert-import-comments.js:134 
      fs.writeFileSync(join(samplesDir, filename), newFileLines.join("\n"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93e4de46c20ea56a — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/web/http-server.js:18 
import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0609b3b1eae656ab — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/samples/web/http-server.js:28 
const API_KEY = process.env.API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae25dfca36ae3853 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/samples/web/http-server.js:70 
      const data = fs.readFileSync(sanitizedPath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e9e51ba211937144 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/license.ts:18 
import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ea30f9f4d96682c9 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/license.ts:22 
const licenseHeader = fs.readFileSync(
  join(__dirname, "./license.txt"),
  "utf-8",
);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #4ab1a6bee093f8ec — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/license.ts:33 
  const fileContents = paths.map((path) => fs.readFileSync(path, "utf-8"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1e4fd9a3772c23d9 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/scripts/license.ts:84 
          return fs.writeFileSync(path, result, "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #263d993e6849bff0 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:26 
import { readFile } from "fs/promises";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #500775128b35763d — Filesystem access.
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:71 
    const fileBuffer = await readFile("./test-utils/cat.png");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #8583eeafb14ec90c — Filesystem access.
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:112 
    const fileBuffer = await readFile("./test-utils/cat.png");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c7c2d593a32d3eed — Filesystem access.
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:147 
    const fileBuffer = await readFile("./test-utils/cat.png");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6c9a898d7d55dd6f — Filesystem access.
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.test.ts:194 
    const fileBuffer = await readFile("./test-utils/cat.png");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1af62425c4163166 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.ts:19 
import { readFileSync } from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4f7f6bade0850bbf — Filesystem access.
pkgs/npm/@[email protected]__reposrc/src/server/file-manager.ts:57 
    const file = fileData instanceof Buffer ? fileData : readFileSync(fileData);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #50ee08b8b6f08ebb — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:42 
      process.env.GEMINI_API_KEY,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #dd64c1cef309f584 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:57 
    const fileManager = new GoogleAIFileManager(process.env.GEMINI_API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #92a93fb3e84c2d7d — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:66 
    const fileManager = new GoogleAIFileManager(process.env.GEMINI_API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c216af446370cb2b — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:77 
    const fileManager = new GoogleAIFileManager(process.env.GEMINI_API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f6c2634c878347c1 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:84 
    const fileManager = new GoogleAIFileManager(process.env.GEMINI_API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a6ee51376712641d — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:96 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #8ad87780a06be6e5 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:114 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #78fbb657677322c5 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:127 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #738698de0d9266b5 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:140 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ae0ff6b41cf77612 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:150 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #0ea3f9f4a31be525 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:160 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #62e58e92017a6bb6 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:186 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #69aef23f0b05fd09 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:203 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #4054497176651330 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:215 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #070c68f5fe7672e3 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:227 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c66ecefc7676e74c — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/abort-signal.test.ts:239 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #767de4861e12cb4f — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:40 
      process.env.GEMINI_API_KEY || "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c438c3ee9c5c970e — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:68 
      process.env.GEMINI_API_KEY || "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6509ddd985b5ad61 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:99 
      process.env.GEMINI_API_KEY || "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ee2b6e5135102b4f — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:130 
      process.env.GEMINI_API_KEY || "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #07f9850f8ccb690e — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:180 
      process.env.GEMINI_API_KEY || "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5e95290501f23f20 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:220 
      process.env.GEMINI_API_KEY || "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #4feb67cfd7ea7abc — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/cache-content.test.ts:240 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6c8b22f1b3b03953 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/count-tokens.test.ts:33 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d26ed4e31d4d609e — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/count-tokens.test.ts:51 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #da2c248c7378db3a — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/count-tokens.test.ts:70 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #defa54ee541885c4 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/embed-content.test.ts:32 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1fdfc596e53f22ad — Filesystem access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-multimodal.test.ts:18 
import * as fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #4a1ad584964bf512 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-multimodal.test.ts:35 
    const imageBuffer = fs.readFileSync(
      join(__dirname, "../../test-utils/cat.png"),
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #2e205609c19b4487 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-multimodal.test.ts:38 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9c991d83365b782e — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-search-grounding.test.ts:37 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #3701032e17d2c14a — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-tools.test.ts:35 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f42cfee83b351b0f — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content-tools.test.ts:179 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #8cb21b7f08f85544 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content.test.ts:39 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ad2c1a685e301ea1 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content.test.ts:66 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f9fce668d553c6f2 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content.test.ts:88 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #445136a80bde326a — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/generate-content.test.ts:103 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #0d6672be8d318c23 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/start-chat-tools.test.ts:76 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #abde2a93f9ad2a4b — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/start-chat.test.ts:32 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c39dd0c3204c875a — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/start-chat.test.ts:55 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #bcf476367b13dab0 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/node/start-chat.test.ts:91 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ae9956a4bee2b047 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:28 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #0c56bd22cb4bcc3c — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:43 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #cf08dc3c3c71bb61 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:66 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9a9ff37eb3a58394 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:89 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b81d860d971d7686 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:125 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #dc8065d0e2f8ddd8 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:173 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #68d4eb1191d0b7e3 — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:196 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9425e1a4c951dcfd — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/test-integration/web/index.test.ts:211 
    const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY || "");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3d76d618bb8e9498 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/test-utils/mock-response.ts:18 
import * as fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #05116c8765d0c248 — Filesystem access.
pkgs/npm/@[email protected]__reposrc/test-utils/mock-response.ts:68 
  const fullText = fs.readFileSync(join(mockResponseDir, filename), "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #72d3e0a3fa020d7e — Filesystem access.
pkgs/npm/@[email protected]__reposrc/test-utils/mock-response.ts:76 
  const fullText = fs.readFileSync(join(mockResponseDir, filename), "utf-8");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e642e95c9a8f803b — Environment-variable access.
pkgs/npm/@[email protected]__reposrc/web-test-runner.config.mjs:17 
        <script>window.process = { env: { GEMINI_API_KEY: "${process.env.GEMINI_API_KEY}" } }</script>

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@mistralai/mistralai

npm dependency
medium pii_flow tooling Excluded from app score unknown #b3d669c709651789 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:30 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:30 
console.log(`Created job with ID: ${job.id}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #7cbc269b3f45e28a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:42 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:42 
  console.log(`Job status: ${job.status}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #71337c16a1faa807 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:45 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:45 
console.log(`Job is done, status ${job.status}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #c1fbf0d84423839c — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:51 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:51 
      console.log(response.body);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #ecf38325d4d13f9f — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:53 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:53 
      console.log(output);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #a30b2786f754dc98 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:59 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:59 
  console.log(`Error file ID: ${job.errorFile}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #aa04ca61b3da54a3 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_chat_no_streaming.ts:15 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_chat_no_streaming.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_chat_no_streaming.ts:15 
console.log("Chat:", chatResponse);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #6bc2f2e5d5ad81ed — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_chat_prediction.ts:33 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_chat_prediction.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_chat_prediction.ts:33 
console.log(chatResponse.choices[0]?.message.content);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #5f13817fa518227b — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_chat_with_image_no_streaming.ts:27 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_chat_with_image_no_streaming.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_chat_with_image_no_streaming.ts:27 
console.log("JSON:", chatResponse.choices[0].message.content);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #8a3781545223d72d — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_embeddings.ts:20 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_embeddings.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_embeddings.ts:20 
console.log("Embeddings Batch:", embeddingsBatchResponse.data);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #ca887b9e897396a2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_files.ts:24 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_files.ts:6 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_files.ts:24 
console.log(createdFile);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #9f9d8223c3691c8a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_files.ts:28 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_files.ts:6 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_files.ts:28 
console.log(files);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #06ee23548d47ddb3 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_files.ts:32 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_files.ts:6 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_files.ts:32 
console.log(retrievedFile);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #87d066cdb45ccbcb — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_files.ts:36 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_files.ts:6 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_files.ts:36 
console.log(deletedFile);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #003e75a2d842f837 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:127 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:127 
  console.log(`calling functionName: ${functionName}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #55cf1c5c5ceb4439 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:128 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:128 
  console.log(`functionParams: ${toolCall.function.arguments}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #92c0d040b4ea89c7 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:147 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:147 
console.log(response.choices[0].message.content);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #c63d2d3586da4438 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:150 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:150 
  console.log(`calling functionName: ${functionName}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #858f3c8b75d0fceb — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:151 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:151 
  console.log(`functionParams: ${toolCall.function.arguments}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #d5e04c72aff06064 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_json_format.ts:16 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_json_format.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_json_format.ts:16 
console.log("Chat:", chatResponse.choices[0].message.content);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #db049d460107813a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:33 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:6 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:33 
console.log("OCR ", ocrResponse);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #6292094271010552 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_url.ts:15 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_url.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_url.ts:15 
console.log("OCR:", ocrResponse);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #edbcd186ee1494ca — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:52 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:4 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:52 
console.log("\n", parsedAccumulatedStream);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #51600d45b77811f7 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:70 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:4 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:70 
console.log("\n", chatResponse.choices[0].message.parsed);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #0729d9b382d541b2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:27 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:27 
console.log("Success", chatResult);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #5b720db0f6158280 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:23 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:23 
console.log(`created prompt ${promptId} (v${prompt.version})`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #bd793fc7402bc1a7 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:38 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:38 
console.log(`production -> v${live.version}: ${live.definition?.content}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #921a17870cb637dc — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:153 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:107 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:153 
        console.error(`\nTranscription error: ${errorMessage}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #39c77dbe734252e3 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:213 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:162 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:213 
        console.error(`Transcription error: ${errorMessage}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #80401d6362e365b2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning.ts:35 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning.ts:35 
  console.log(content);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #410d886d043691fa — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning.ts:42 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning.ts:42 
          console.log(inner.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #6dd1388c5edaeb46 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning.ts:47 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning.ts:47 
      console.log(chunk.text);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #f9cbf92877dd8ff2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:61 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:14 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:61 
  console.log(
    `turn ${i + 1}: prompt=${String(promptTokens).padStart(4)} ` +
      `completion=${String(completionTokens).padStart(4)}  -> ${finalText(message.content)}`,
  );

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #8efd750c334e442e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:74 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:14 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:74 
console.log(
  `TOTAL: prompt=${totalPrompt} completion=${totalCompletion} ` +
    `(sum ${totalPrompt + totalCompletion})`,
);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #3c6d7ac6ddeefc09 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:30 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:7 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:30 
  console.log(`typeof content = ${Array.isArray(content) ? "Array" : typeof content}`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #07df972380bd13f2 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:32 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:7 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:32 
  console.log(JSON.stringify(content, null, 2));

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #1e24d617356eb4b6 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:30 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:30 
console.log(
  `created skill ${skillId} (v${skill.version}), assets: ${Object.keys(
    skill.definition?.assets ?? {},
  )}`,
);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #d758b73c39e12a6e — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:47 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:47 
console.log(`published v${version.version}, moved 'main' to it`);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #817bee01cef864b1 — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:50 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:50 
console.log(
  `main -> v${runnable.version}: ${runnable.definition?.description}`,
);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
medium pii_flow tooling Excluded from app score unknown #19908b935e37a96a — PII-bearing data is written to a log sink. Logged PII is a privacy concern even when it does not leave the process.
pkgs/npm/@[email protected]/packages/mistralai-azure/examples/chatComplete.example.ts:35 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/packages/mistralai-azure/examples/chatComplete.example.ts:18 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/packages/mistralai-azure/examples/chatComplete.example.ts:35 
  console.log(result);

PII-bearing data is written to a log/print sink — it stays in-process and does not leave the application, but logged PII is still a privacy concern.

Fix: Avoid logging user identifiers; redact or omit PII from log/print statements.
expand_more 59 low-confidence finding(s)
low egress dependency Excluded from app score #058b94b7ef5ae3fd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/hooks/tracing.js:52 
            return this.wrappedClient.request(request);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c5513cb1525a2306 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/hooks/tracing.js:58 
                return await this.wrappedClient.request(request);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f9a784aa847615f7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/hooks/tracing.js:60 
            return await observability.runWithContext(activeContext, () => this.wrappedClient.request(request));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #13ed6cee2c836108 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/lib/http.js:11 
        return fetch(input);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5ef28d26f7dbb218 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/lib/http.js:14 
        return fetch(input, init);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f5297cb676c8baa5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/esm/lib/sdks.js:147 
            let response = await this.#httpClient.request(req);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #fbf060301634c158 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_audio_transcription_diarize.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d877e1709b373215 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_audio_transcription_stream.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ee95d7d2ac58e728 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_batch_jobs.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5224f08ba196130f — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_chat_no_streaming.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #552be9d2ac2f12d2 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_chat_prediction.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f876f1ab20d0dc9e — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_chat_streaming.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #0cf68c8ba0006b21 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_chat_with_image_no_streaming.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b0c4ba444466a989 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_conversation_agent.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ca90f1b5f75bc259 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_embeddings.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d9a631fde1863abf — Filesystem access.
pkgs/npm/@[email protected]/examples/src/async_files.ts:1 
import * as fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #fb23cc1c196d3334 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_files.ts:6 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #db5d54896b0cd1f0 — Filesystem access.
pkgs/npm/@[email protected]/examples/src/async_files.ts:19 
const blob = new Blob([fs.readFileSync(filePath)], {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a5fc3ad736e79ce7 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_function_calling.ts:4 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1e9cd812b71b8dcc — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_function_calling_streaming.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c8199d6eae33b8a2 — Filesystem access.
pkgs/npm/@[email protected]/examples/src/async_jobs.ts:1 
import * as fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a5c47564e47c309b — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_jobs.ts:6 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #748933f3ad8817e0 — Filesystem access.
pkgs/npm/@[email protected]/examples/src/async_jobs.ts:19 
const blob = new Blob([fs.readFileSync(filePath)], {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #bc85329736b00b4f — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_json_format.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #649b74bc06f44770 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_list_models.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #3e2920d95494182b — Filesystem access.
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:2 
import fs from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c053b4584eac9254 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:6 
const apiKey = process.env.MISTRAL_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9746ed73dccfa4a0 — Filesystem access.
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_file.ts:16 
const uploaded_file = fs.readFileSync(filePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #aad458ec1d8dc26c — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_ocr_process_from_url.ts:3 
const apiKey = process.env.MISTRAL_API_KEY;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #039e394e80e5bce6 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/async_structured_outputs.ts:4 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f471cebc232dead7 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:3 
const azureAPIKey = process.env["AZURE_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #115e2fd7197e3435 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/azure/async_chat_no_streaming.ts:8 
const azureEndpoint = process.env["AZURE_ENDPOINT"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #79eb857929f0469f — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/error_handling.ts:4 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #051a0e80dac58cf4 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/gcp/async_chat_no_streaming.ts:3 
const projectId = process.env["GOOGLE_PROJECT_ID"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9da30a22af5a8c47 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/prompt_lifecycle.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e2599a7c56a91289 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:38 
      default: process.env["MISTRAL_API_KEY"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7900ec368bf023f7 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:43 
      default: process.env["MISTRAL_BASE_URL"] ?? "wss://api.mistral.ai",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6848ea53c5b00e61 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/realtime_microphone.ts:107 
  const apiKey = args.apiKey ?? process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #76cb720f936a48d3 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:46 
      default: process.env["MISTRAL_API_KEY"],

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #83fd8fa2fa4a826b — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:51 
      default: process.env["MISTRAL_BASE_URL"] ?? "https://api.mistral.ai",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7431a106c86a3976 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/realtime_transcription.ts:162 
  const apiKey = args.apiKey ?? process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #4059a602fa55245b — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/reasoning.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #9bc5433ab2960511 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/reasoning_multi_turn.ts:14 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #0dfa66baf87e2b42 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/reasoning_response_shape.ts:7 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #748ee79e66285ad8 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/reasoning_with_streaming.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #38837d827b37d247 — Environment-variable access.
pkgs/npm/@[email protected]/examples/src/skill_lifecycle.ts:3 
const apiKey = process.env["MISTRAL_API_KEY"];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #69447cb303b818b3 — Environment-variable access.
pkgs/npm/@[email protected]/packages/mistralai-azure/examples/chatComplete.example.ts:18 
  apiKey: process.env["MISTRAL_API_KEY"] ?? "",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #62d120b59bf903e6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/packages/mistralai-azure/src/lib/http.ts:19 
    return fetch(input);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f83e016e7d1f4206 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/packages/mistralai-azure/src/lib/http.ts:21 
    return fetch(input, init);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f1d3645b7752aa9e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/packages/mistralai-azure/src/lib/sdks.ts:259 
        let response = await this.#httpClient.request(req);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #064d9390fc36fe96 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/packages/mistralai-gcp/src/lib/http.ts:19 
    return fetch(input);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8474615bafd1e753 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/packages/mistralai-gcp/src/lib/http.ts:21 
    return fetch(input, init);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #25efdfc1c6f11cbc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/packages/mistralai-gcp/src/lib/sdks.ts:255 
        let response = await this.#httpClient.request(req);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #59b339e031bad0be — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/hooks/tracing.ts:82 
      return this.wrappedClient.request(request);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4980475fbf391b75 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/hooks/tracing.ts:89 
        return await this.wrappedClient.request(request);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2b6082cba8def1ff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/hooks/tracing.ts:94 
        () => this.wrappedClient.request(request)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #40a96898e37329b3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/lib/http.ts:19 
    return fetch(input);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f40630b58d2f3ca6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/lib/http.ts:21 
    return fetch(input, init);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #614fdd9eff291fb8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/lib/sdks.ts:259 
        let response = await this.#httpClient.request(req);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

@anthropic-ai/sdk

npm dependency
medium pii_flow dependency Excluded from app score #7e3ace8f27c26820 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/oidc-federation.js:42 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/lib/credentials/oidc-federation.js:39 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/lib/credentials/oidc-federation.js:42 
            resp = await config.fetch(url, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                    'anthropic-beta': `${types_1.OAUTH_API_BETA_HEADER},${types_1.FEDERATION_BETA_HEADER}`,
                    'User-Agent': config.userAgent || `anthropic-sdk-typescript/${version_1.VERSION} oidcFederationProvider`,
                },
                body: JSON.stringify(body),
            });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow dependency Excluded from app score #7b19805c405a4127 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/oidc-federation.mjs:39 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/lib/credentials/oidc-federation.mjs:36 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/lib/credentials/oidc-federation.mjs:39 
            resp = await config.fetch(url, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                    'anthropic-beta': `${OAUTH_API_BETA_HEADER},${FEDERATION_BETA_HEADER}`,
                    'User-Agent': config.userAgent || `anthropic-sdk-typescript/${VERSION} oidcFederationProvider`,
                },
                body: JSON.stringify(body),
            });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow dependency Excluded from app score #5b11d9118b8f858e — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:94 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:91 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:94 
            resp = await config.fetch(url, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                    'anthropic-beta': types_1.OAUTH_API_BETA_HEADER,
                    'User-Agent': config.userAgent || `anthropic-sdk-typescript/${version_1.VERSION} userOAuthProvider`,
                },
                body: JSON.stringify(body),
            });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow dependency Excluded from app score #c33572385fe5ea5b — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:58 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:55 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:58 
            resp = await config.fetch(url, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                    'anthropic-beta': OAUTH_API_BETA_HEADER,
                    'User-Agent': config.userAgent || `anthropic-sdk-typescript/${VERSION} userOAuthProvider`,
                },
                body: JSON.stringify(body),
            });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow dependency Excluded from app score #44e56bfbf84344c9 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/src/lib/credentials/oidc-federation.ts:83 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/src/lib/credentials/oidc-federation.ts:80 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/src/lib/credentials/oidc-federation.ts:83 
      resp = await config.fetch(url, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'anthropic-beta': `${OAUTH_API_BETA_HEADER},${FEDERATION_BETA_HEADER}`,
          'User-Agent': config.userAgent || `anthropic-sdk-typescript/${VERSION} oidcFederationProvider`,
        },
        body: JSON.stringify(body),
      });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow dependency Excluded from app score #0068cfff1dc504aa — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:95 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:92 → /tmp/closeopen-jglvjeb9/pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:95 
      resp = await config.fetch(url, {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'anthropic-beta': OAUTH_API_BETA_HEADER,
          'User-Agent': config.userAgent || `anthropic-sdk-typescript/${VERSION} userOAuthProvider`,
        },
        body: JSON.stringify(body),
      });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
expand_more 266 low-confidence finding(s)
low env_fs dependency Excluded from app score #a5b5ad15ac08bffa — Filesystem access.
pkgs/npm/@[email protected]/core/credentials.js:110 
        configRaw = await fs.promises.readFile(configPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #85b586ebaa573ac9 — Filesystem access.
pkgs/npm/@[email protected]/core/credentials.js:210 
        raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bc8a561bc6d91c7d — Filesystem access.
pkgs/npm/@[email protected]/core/credentials.js:308 
        return (await fs.promises.readFile(filePath, 'utf-8')).trim() || 'default';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b393fa28cf746580 — Filesystem access.
pkgs/npm/@[email protected]/core/credentials.mjs:73 
        configRaw = await fs.promises.readFile(configPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #5e2b6a765555ab67 — Filesystem access.
pkgs/npm/@[email protected]/core/credentials.mjs:172 
        raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #605f352ce3c93cf6 — Filesystem access.
pkgs/npm/@[email protected]/core/credentials.mjs:268 
        return (await fs.promises.readFile(filePath, 'utf-8')).trim() || 'default';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9508fe743aab9a02 — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/credential-chain.js:203 
            const raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #87f0fd99b9fa78d4 — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/credential-chain.mjs:166 
            const raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #528ced37a8799c71 — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/identity-token.js:51 
            content = await fs.promises.readFile(path, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ad7b7de180d738cf — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/identity-token.mjs:14 
            content = await fs.promises.readFile(path, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65efbeb456550a78 — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/types.js:195 
            await fh.writeFile(JSON.stringify(data, null, 2));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #2c7f7f61c572e65e — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/types.mjs:154 
            await fh.writeFile(JSON.stringify(data, null, 2));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9ccf09c3d512a3c8 — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/user-oauth.js:56 
            raw = await fs.promises.readFile(config.credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e8f49b7165cda1a4 — Filesystem access.
pkgs/npm/@[email protected]/lib/credentials/user-oauth.mjs:20 
            raw = await fs.promises.readFile(config.credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #0811ed5ab08345c5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/agents/agents.js:53 
        return this._client.get((0, path_1.path) `/v1/agents/${agentID}?beta=true`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #973be9e6a4c69f40 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/agents/agents.js:76 
        return this._client.post((0, path_1.path) `/v1/agents/${agentID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dc2df2810455ab5e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/agents/agents.js:120 
        return this._client.post((0, path_1.path) `/v1/agents/${agentID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #67105a9c1eee741c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/agents/agents.mjs:49 
        return this._client.get(path `/v1/agents/${agentID}?beta=true`, {
            query,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #42bb95b600c7d31e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/agents/agents.mjs:72 
        return this._client.post(path `/v1/agents/${agentID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dd9b93c18198325d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/agents/agents.mjs:116 
        return this._client.post(path `/v1/agents/${agentID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e849d72c30a2c315 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployment-runs.js:23 
        return this._client.get((0, path_1.path) `/v1/deployment_runs/${deploymentRunID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1e253873409a190f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployment-runs.mjs:20 
        return this._client.get(path `/v1/deployment_runs/${deploymentRunID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #27d60cd2c24c4676 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.js:58 
        return this._client.get((0, path_1.path) `/v1/deployments/${deploymentID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1759b424c624a6d6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.js:79 
        return this._client.post((0, path_1.path) `/v1/deployments/${deploymentID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b19d6a51bb26a841 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.js:123 
        return this._client.post((0, path_1.path) `/v1/deployments/${deploymentID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f5dd7a33e45479db — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.js:144 
        return this._client.post((0, path_1.path) `/v1/deployments/${deploymentID}/pause?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ff2050a39a7c76e5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.js:165 
        return this._client.post((0, path_1.path) `/v1/deployments/${deploymentID}/run?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #111bfe15745743d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.js:186 
        return this._client.post((0, path_1.path) `/v1/deployments/${deploymentID}/unpause?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e3b1bb7b64c9d0e5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:55 
        return this._client.get(path `/v1/deployments/${deploymentID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e7bc28b69a1b4286 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:76 
        return this._client.post(path `/v1/deployments/${deploymentID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3e68eed6e1ad77b0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:120 
        return this._client.post(path `/v1/deployments/${deploymentID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b8559d84affedfd4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:141 
        return this._client.post(path `/v1/deployments/${deploymentID}/pause?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #de2ac9dd5e8968b8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:162 
        return this._client.post(path `/v1/deployments/${deploymentID}/run?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #367dd4e972e0ce7c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/deployments.mjs:183 
        return this._client.post(path `/v1/deployments/${deploymentID}/unpause?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b53815cca24b8df9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/dreams.js:44 
        return this._client.get((0, path_1.path) `/v1/dreams/${dreamID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6e8977c5f596e352 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/dreams.js:86 
        return this._client.post((0, path_1.path) `/v1/dreams/${dreamID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5cbf45bc829f541f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/dreams.js:106 
        return this._client.post((0, path_1.path) `/v1/dreams/${dreamID}/cancel?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fc0253d712b3a8a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/dreams.mjs:41 
        return this._client.get(path `/v1/dreams/${dreamID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1741c0fd21d6df53 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/dreams.mjs:83 
        return this._client.post(path `/v1/dreams/${dreamID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #91f5aa38a1b05465 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/dreams.mjs:103 
        return this._client.post(path `/v1/dreams/${dreamID}/cancel?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fc2d93456e09da5f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/environments.js:52 
        return this._client.get((0, path_1.path) `/v1/environments/${environmentID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #004006755839ba20 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/environments.js:73 
        return this._client.post((0, path_1.path) `/v1/environments/${environmentID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ef54193f8bbef5cb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/environments.js:139 
        return this._client.post((0, path_1.path) `/v1/environments/${environmentID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #674305fc5bb12884 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/environments.mjs:48 
        return this._client.get(path `/v1/environments/${environmentID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #087fbf8bfe110d93 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/environments.mjs:69 
        return this._client.post(path `/v1/environments/${environmentID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3276d90e50e090ea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/environments.mjs:135 
        return this._client.post(path `/v1/environments/${environmentID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3e4d79b1b67e4a43 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:30 
        return this._client.get((0, path_1.path) `/v1/environments/${environment_id}/work/${workID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #50eba9252d19a5d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:57 
        return this._client.post((0, path_1.path) `/v1/environments/${environment_id}/work/${workID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d3b4ab2831c577e2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:114 
        return this._client.post((0, path_1.path) `/v1/environments/${environment_id}/work/${workID}/ack?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #01009bbddb03b398 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:140 
        return this._client.post((0, path_1.path) `/v1/environments/${environment_id}/work/${workID}/heartbeat?beta=true`, {
            query: { desired_ttl_seconds, expected_last_heartbeat },
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6d946dd6f17607e0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:167 
        return this._client.get((0, path_1.path) `/v1/environments/${environmentID}/work/poll?beta=true`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                {
                    'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString(),
                    ...(anthropicWorkerID != null ? { 'Anthropic-Worker-ID': anthropicWorkerID } : undefined),
                },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a38328aaf2058873 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:192 
        return this._client.get((0, path_1.path) `/v1/environments/${environmentID}/work/stats?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e707cce931f46061 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.js:218 
        return this._client.post((0, path_1.path) `/v1/environments/${environment_id}/work/${workID}/stop?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9fc9dc187660e2fd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:27 
        return this._client.get(path `/v1/environments/${environment_id}/work/${workID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8879b97bce9c8183 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:54 
        return this._client.post(path `/v1/environments/${environment_id}/work/${workID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2f6675b0430f559f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:111 
        return this._client.post(path `/v1/environments/${environment_id}/work/${workID}/ack?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #58827d123eaa9e84 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:137 
        return this._client.post(path `/v1/environments/${environment_id}/work/${workID}/heartbeat?beta=true`, {
            query: { desired_ttl_seconds, expected_last_heartbeat },
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #21754b09be12ab62 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:164 
        return this._client.get(path `/v1/environments/${environmentID}/work/poll?beta=true`, {
            query,
            ...options,
            headers: buildHeaders([
                {
                    'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString(),
                    ...(anthropicWorkerID != null ? { 'Anthropic-Worker-ID': anthropicWorkerID } : undefined),
                },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0bdfbf3031e90e4a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:189 
        return this._client.get(path `/v1/environments/${environmentID}/work/stats?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fbd0920c93b3a2d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/environments/work.mjs:215 
        return this._client.post(path `/v1/environments/${environment_id}/work/${workID}/stop?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3fc4822a3ae393ae — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/files.js:69 
        return this._client.get((0, path_1.path) `/v1/files/${fileID}/content?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                {
                    'anthropic-beta': [...(betas ?? []), 'files-api-2025-04-14'].toString(),
                    Accept: 'application/binary',
                },
                options?.headers,
            ]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2ec0f2129a829005 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/files.js:92 
        return this._client.get((0, path_1.path) `/v1/files/${fileID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'files-api-2025-04-14'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2e85b614fe1022c7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/files.mjs:66 
        return this._client.get(path `/v1/files/${fileID}/content?beta=true`, {
            ...options,
            headers: buildHeaders([
                {
                    'anthropic-beta': [...(betas ?? []), 'files-api-2025-04-14'].toString(),
                    Accept: 'application/binary',
                },
                options?.headers,
            ]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ddb5832b107565bf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/files.mjs:89 
        return this._client.get(path `/v1/files/${fileID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'files-api-2025-04-14'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #92c320402daacb7f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.js:24 
        return this._client.post((0, path_1.path) `/v1/memory_stores/${memoryStoreID}/memories?beta=true`, {
            query: { view },
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1d30c70ca806bcd9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.js:48 
        return this._client.get((0, path_1.path) `/v1/memory_stores/${memory_store_id}/memories/${memoryID}?beta=true`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a8e5bb642a6ebe96 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.js:71 
        return this._client.post((0, path_1.path) `/v1/memory_stores/${memory_store_id}/memories/${memoryID}?beta=true`, {
            query: { view },
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #eb7dd2bea571c9f5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.mjs:21 
        return this._client.post(path `/v1/memory_stores/${memoryStoreID}/memories?beta=true`, {
            query: { view },
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #321f9efc0153702e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.mjs:45 
        return this._client.get(path `/v1/memory_stores/${memory_store_id}/memories/${memoryID}?beta=true`, {
            query,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b6ac3fa52335cc5a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memories.mjs:68 
        return this._client.post(path `/v1/memory_stores/${memory_store_id}/memories/${memoryID}?beta=true`, {
            query: { view },
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #48e6e9af58c7e8f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.js:53 
        return this._client.get((0, path_1.path) `/v1/memory_stores/${memoryStoreID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f0b201414b1539fc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.js:72 
        return this._client.post((0, path_1.path) `/v1/memory_stores/${memoryStoreID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f5a7b10173a0167a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.js:133 
        return this._client.post((0, path_1.path) `/v1/memory_stores/${memoryStoreID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8f535157df2a00ec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.mjs:49 
        return this._client.get(path `/v1/memory_stores/${memoryStoreID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e180b429f2fde40a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.mjs:68 
        return this._client.post(path `/v1/memory_stores/${memoryStoreID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #acc5b903a2b15531 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-stores.mjs:129 
        return this._client.post(path `/v1/memory_stores/${memoryStoreID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #24de0518868386e5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-versions.js:24 
        return this._client.get((0, path_1.path) `/v1/memory_stores/${memory_store_id}/memory_versions/${memoryVersionID}?beta=true`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #68959a86400ba61d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-versions.js:71 
        return this._client.post((0, path_1.path) `/v1/memory_stores/${memory_store_id}/memory_versions/${memoryVersionID}/redact?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #10fd6a76ed08c7d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-versions.mjs:21 
        return this._client.get(path `/v1/memory_stores/${memory_store_id}/memory_versions/${memoryVersionID}?beta=true`, {
            query,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7d72168b56e3a58f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/memory-stores/memory-versions.mjs:68 
        return this._client.post(path `/v1/memory_stores/${memory_store_id}/memory_versions/${memoryVersionID}/redact?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7854231ec61cb95a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/messages/batches.js:73 
        return this._client.get((0, path_1.path) `/v1/messages/batches/${messageBatchID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2bf1154a8759ae0f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/messages/batches.js:158 
        return this._client.post((0, path_1.path) `/v1/messages/batches/${messageBatchID}/cancel?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #43e83b607a85ecf6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/messages/batches.js:190 
        return this._client
            .get(batch.results_url, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                {
                    'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString(),
                    Accept: 'application/binary',
                },
                options?.headers,
            ]),
            stream: true,
            __binaryResponse: true,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dbe0d54a7d6aa481 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/messages/batches.mjs:70 
        return this._client.get(path `/v1/messages/batches/${messageBatchID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d870a855c81d6c85 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/messages/batches.mjs:155 
        return this._client.post(path `/v1/messages/batches/${messageBatchID}/cancel?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8aee01237270791a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/messages/batches.mjs:187 
        return this._client
            .get(batch.results_url, {
            ...options,
            headers: buildHeaders([
                {
                    'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString(),
                    Accept: 'application/binary',
                },
                options?.headers,
            ]),
            stream: true,
            __binaryResponse: true,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8891ec45e3b4704e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/models.js:25 
        return this._client.get((0, path_1.path) `/v1/models/${modelID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b6c77b20f5ff4f89 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/models.mjs:22 
        return this._client.get(path `/v1/models/${modelID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fe09f9949f87261a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/events.js:61 
        return this._client.post((0, path_1.path) `/v1/sessions/${sessionID}/events?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d3d7a8bf5a7569bf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/events.js:83 
        return this._client.get((0, path_1.path) `/v1/sessions/${sessionID}/events/stream?beta=true`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
            stream: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #13aa4fc325c390f6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/events.mjs:58 
        return this._client.post(path `/v1/sessions/${sessionID}/events?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #18fc5ffa413360c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/events.mjs:80 
        return this._client.get(path `/v1/sessions/${sessionID}/events/stream?beta=true`, {
            query,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
            stream: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d1a688827452b080 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/resources.js:24 
        return this._client.get((0, path_1.path) `/v1/sessions/${session_id}/resources/${resourceID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #816f48736679ab7b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/resources.js:49 
        return this._client.post((0, path_1.path) `/v1/sessions/${session_id}/resources/${resourceID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bfd900bdbdbf3183 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/resources.js:121 
        return this._client.post((0, path_1.path) `/v1/sessions/${sessionID}/resources?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fdb2fbe3ba715434 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/resources.mjs:21 
        return this._client.get(path `/v1/sessions/${session_id}/resources/${resourceID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #884f16ef13961883 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/resources.mjs:46 
        return this._client.post(path `/v1/sessions/${session_id}/resources/${resourceID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2d61a4fa76437c51 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/resources.mjs:118 
        return this._client.post(path `/v1/sessions/${sessionID}/resources?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f34cb7a5afdf9d5f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.js:59 
        return this._client.get((0, path_1.path) `/v1/sessions/${sessionID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f2bf9886b5dd7b7f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.js:80 
        return this._client.post((0, path_1.path) `/v1/sessions/${sessionID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0f50fd5709a75843 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.js:145 
        return this._client.post((0, path_1.path) `/v1/sessions/${sessionID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #00824e49c1170352 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.mjs:55 
        return this._client.get(path `/v1/sessions/${sessionID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #da4d3f2412b94e63 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.mjs:76 
        return this._client.post(path `/v1/sessions/${sessionID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bcc8652b7c6cd9da — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/sessions.mjs:141 
        return this._client.post(path `/v1/sessions/${sessionID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0d2d9175448bc896 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/threads/events.js:49 
        return this._client.get((0, path_1.path) `/v1/sessions/${session_id}/threads/${threadID}/stream?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
            stream: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b66001f74a805ad4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/threads/events.mjs:46 
        return this._client.get(path `/v1/sessions/${session_id}/threads/${threadID}/stream?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
            stream: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6a6f4c967be98693 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/threads/threads.js:31 
        return this._client.get((0, path_1.path) `/v1/sessions/${session_id}/threads/${threadID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9660b9cf3cf24d10 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/threads/threads.js:77 
        return this._client.post((0, path_1.path) `/v1/sessions/${session_id}/threads/${threadID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1804b67584de02ec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/threads/threads.mjs:27 
        return this._client.get(path `/v1/sessions/${session_id}/threads/${threadID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #902ec286aa96dabe — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/sessions/threads/threads.mjs:73 
        return this._client.post(path `/v1/sessions/${session_id}/threads/${threadID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6ac3a69619f547b0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/skills.js:49 
        return this._client.get((0, path_1.path) `/v1/skills/${skillID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ace2afab046c9466 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/skills.mjs:45 
        return this._client.get(path `/v1/skills/${skillID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b268c2326fe81329 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/versions.js:24 
        return this._client.post((0, path_1.path) `/v1/skills/${skillID}/versions?beta=true`, (0, uploads_1.multipartFormRequestOptions)({
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
                options?.headers,
            ]),
        }, this._client, false));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5281cdd9379fab1c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/versions.js:46 
        return this._client.get((0, path_1.path) `/v1/skills/${skill_id}/versions/${version}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fa018dddc66eaa0f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/versions.js:115 
        return this._client.get((0, path_1.path) `/v1/skills/${skill_id}/versions/${version}/content?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                {
                    'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString(),
                    Accept: 'application/binary',
                },
                options?.headers,
            ]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #753b03c49faeaaf5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/versions.mjs:21 
        return this._client.post(path `/v1/skills/${skillID}/versions?beta=true`, multipartFormRequestOptions({
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
                options?.headers,
            ]),
        }, this._client, false));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #347d00ceb41fe8cf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/versions.mjs:43 
        return this._client.get(path `/v1/skills/${skill_id}/versions/${version}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #009df795b294e93a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/skills/versions.mjs:112 
        return this._client.get(path `/v1/skills/${skill_id}/versions/${version}/content?beta=true`, {
            ...options,
            headers: buildHeaders([
                {
                    'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString(),
                    Accept: 'application/binary',
                },
                options?.headers,
            ]),
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #57b6f845fc3e0939 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.js:31 
        return this._client.post((0, path_1.path) `/v1/tunnels/${tunnelID}/certificates?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dc2f44c27a8eb0ad — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.js:59 
        return this._client.get((0, path_1.path) `/v1/tunnels/${tunnel_id}/certificates/${certificateID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #057092ee559be95c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.js:119 
        return this._client.post((0, path_1.path) `/v1/tunnels/${tunnel_id}/certificates/${certificateID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #79570a06d7ac72c2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.mjs:28 
        return this._client.post(path `/v1/tunnels/${tunnelID}/certificates?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #714c4896721d10db — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.mjs:56 
        return this._client.get(path `/v1/tunnels/${tunnel_id}/certificates/${certificateID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #094632740792453f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/certificates.mjs:116 
        return this._client.post(path `/v1/tunnels/${tunnel_id}/certificates/${certificateID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0df0bc1db6511b9b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.js:60 
        return this._client.get((0, path_1.path) `/v1/tunnels/${tunnelID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e8a136d3e758ae6f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.js:116 
        return this._client.post((0, path_1.path) `/v1/tunnels/${tunnelID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5734450bb4cf6daa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.js:143 
        return this._client.post((0, path_1.path) `/v1/tunnels/${tunnelID}/reveal_token?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2b42aaa03ea9500a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.js:169 
        return this._client.post((0, path_1.path) `/v1/tunnels/${tunnelID}/rotate_token?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4081de02ffa674ab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.mjs:56 
        return this._client.get(path `/v1/tunnels/${tunnelID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9381a085213f75c2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.mjs:112 
        return this._client.post(path `/v1/tunnels/${tunnelID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4f3d4b9b7fda9642 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.mjs:139 
        return this._client.post(path `/v1/tunnels/${tunnelID}/reveal_token?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #762952b2451d8ade — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/tunnels/tunnels.mjs:165 
        return this._client.post(path `/v1/tunnels/${tunnelID}/rotate_token?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #40e760ffee84f617 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/user-profiles.js:43 
        return this._client.get((0, path_1.path) `/v1/user_profiles/${userProfileID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #04b528ed365068a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/user-profiles.js:64 
        return this._client.post((0, path_1.path) `/v1/user_profiles/${userProfileID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c621fad819e8a1a9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/user-profiles.js:108 
        return this._client.post((0, path_1.path) `/v1/user_profiles/${userProfileID}/enrollment_url?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b80e7a42cf1ab76b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/user-profiles.mjs:40 
        return this._client.get(path `/v1/user_profiles/${userProfileID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ca9a596f98737b2d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/user-profiles.mjs:61 
        return this._client.post(path `/v1/user_profiles/${userProfileID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e1a05c3b96694f5e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/user-profiles.mjs:105 
        return this._client.post(path `/v1/user_profiles/${userProfileID}/enrollment_url?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d2710201a7014f98 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:31 
        return this._client.post((0, path_1.path) `/v1/vaults/${vaultID}/credentials?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #973f2591b8113596 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:54 
        return this._client.get((0, path_1.path) `/v1/vaults/${vault_id}/credentials/${credentialID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b514213ef4f6bd52 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:76 
        return this._client.post((0, path_1.path) `/v1/vaults/${vault_id}/credentials/${credentialID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f292f80043a79d0a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:145 
        return this._client.post((0, path_1.path) `/v1/vaults/${vault_id}/credentials/${credentialID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d98c9969afd9559a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.js:167 
        return this._client.post((0, path_1.path) `/v1/vaults/${vault_id}/credentials/${credentialID}/mcp_oauth_validate?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4fd5f2e0bea19a3f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:28 
        return this._client.post(path `/v1/vaults/${vaultID}/credentials?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b1f8c9df73c15aec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:51 
        return this._client.get(path `/v1/vaults/${vault_id}/credentials/${credentialID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ab342eb133558b93 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:73 
        return this._client.post(path `/v1/vaults/${vault_id}/credentials/${credentialID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8a98edb9edcc78cd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:142 
        return this._client.post(path `/v1/vaults/${vault_id}/credentials/${credentialID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1d8e72bdf2b653c3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/credentials.mjs:164 
        return this._client.post(path `/v1/vaults/${vault_id}/credentials/${credentialID}/mcp_oauth_validate?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #03ec95aa56df8e2f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.js:52 
        return this._client.get((0, path_1.path) `/v1/vaults/${vaultID}?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #404c62013ef93928 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.js:73 
        return this._client.post((0, path_1.path) `/v1/vaults/${vaultID}?beta=true`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3d46009dcbf90c0f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.js:138 
        return this._client.post((0, path_1.path) `/v1/vaults/${vaultID}/archive?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ca43bb0091c18e00 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.mjs:48 
        return this._client.get(path `/v1/vaults/${vaultID}?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6fae3635096ca76f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.mjs:69 
        return this._client.post(path `/v1/vaults/${vaultID}?beta=true`, {
            body,
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1a2d1dedf6cba5ee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/beta/vaults/vaults.mjs:134 
        return this._client.post(path `/v1/vaults/${vaultID}/archive?beta=true`, {
            ...options,
            headers: buildHeaders([
                { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7f4aa4ff0ed96f31 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/messages/batches.js:67 
        return this._client.get((0, path_1.path) `/v1/messages/batches/${messageBatchID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e9197a2ebfbae26e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/messages/batches.js:127 
        return this._client.post((0, path_1.path) `/v1/messages/batches/${messageBatchID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e54b8f3daeb309a8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/messages/batches.js:150 
        return this._client
            .get(batch.results_url, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            stream: true,
            __binaryResponse: true,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #72ee81758f1f8a9d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/messages/batches.mjs:64 
        return this._client.get(path `/v1/messages/batches/${messageBatchID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #04b92ded183baf2a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/messages/batches.mjs:124 
        return this._client.post(path `/v1/messages/batches/${messageBatchID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f429d372dd53ebd5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/messages/batches.mjs:147 
        return this._client
            .get(batch.results_url, {
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            stream: true,
            __binaryResponse: true,
        })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9ab53bf1466ca036 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/models.js:18 
        return this._client.get((0, path_1.path) `/v1/models/${modelID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7fd24e947ab3c582 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/resources/models.mjs:15 
        return this._client.get(path `/v1/models/${modelID}`, {
            ...options,
            headers: buildHeaders([
                { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #f6ae3d2ffd9c9ad2 — Filesystem access.
pkgs/npm/@[email protected]/src/core/credentials.ts:154 
    configRaw = await fs.promises.readFile(configPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6fff283c41bfd169 — Filesystem access.
pkgs/npm/@[email protected]/src/core/credentials.ts:258 
    raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1288b91757d66859 — Filesystem access.
pkgs/npm/@[email protected]/src/core/credentials.ts:372 
    return (await fs.promises.readFile(filePath, 'utf-8')).trim() || 'default';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0611ccfedbf14949 — Filesystem access.
pkgs/npm/@[email protected]/src/lib/credentials/credential-chain.ts:250 
      const raw = await fs.promises.readFile(credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #23c1cf099908c36f — Filesystem access.
pkgs/npm/@[email protected]/src/lib/credentials/identity-token.ts:17 
      content = await fs.promises.readFile(path, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #894902e9273c7098 — Filesystem access.
pkgs/npm/@[email protected]/src/lib/credentials/types.ts:222 
      await fh.writeFile(JSON.stringify(data, null, 2));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b1ab9c26a136e2da — Filesystem access.
pkgs/npm/@[email protected]/src/lib/credentials/user-oauth.ts:45 
      raw = await fs.promises.readFile(config.credentialsPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #a21f336cbc9f80c7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/agents/agents.ts:58 
    return this._client.get(path`/v1/agents/${agentID}?beta=true`, {
      query,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fa7c3b76a424a9ab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/agents/agents.ts:86 
    return this._client.post(path`/v1/agents/${agentID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a3ff6cd54b8a0e3b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/agents/agents.ts:139 
    return this._client.post(path`/v1/agents/${agentID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ea03d751c9338563 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployment-runs.ts:30 
    return this._client.get(path`/v1/deployment_runs/${deploymentRunID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c30174dff31d406a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:69 
    return this._client.get(path`/v1/deployments/${deploymentID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3ca1678d1966f558 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:95 
    return this._client.post(path`/v1/deployments/${deploymentID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4241102e781faf79 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:148 
    return this._client.post(path`/v1/deployments/${deploymentID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #259a616634f70bf7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:174 
    return this._client.post(path`/v1/deployments/${deploymentID}/pause?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #826f5f1d3fce81d3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:200 
    return this._client.post(path`/v1/deployments/${deploymentID}/run?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4c500b58ac4521d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/deployments.ts:226 
    return this._client.post(path`/v1/deployments/${deploymentID}/unpause?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0b804e09c912c8c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/dreams.ts:51 
    return this._client.get(path`/v1/dreams/${dreamID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #12793c53d7db1eda — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/dreams.ts:102 
    return this._client.post(path`/v1/dreams/${dreamID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a023b053b1893ac3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/dreams.ts:127 
    return this._client.post(path`/v1/dreams/${dreamID}/cancel?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'dreaming-2026-04-21'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dc4d04c0bd414282 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/environments.ts:74 
    return this._client.get(path`/v1/environments/${environmentID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d2195580145f17c5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/environments.ts:100 
    return this._client.post(path`/v1/environments/${environmentID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #edfad49dbb07a3ab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/environments.ts:180 
    return this._client.post(path`/v1/environments/${environmentID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #743cf4cfa1e9ddec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:43 
    return this._client.get(path`/v1/environments/${environment_id}/work/${workID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #98c51ee81d7a33d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:71 
    return this._client.post(path`/v1/environments/${environment_id}/work/${workID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #85e37b902345fa40 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:138 
    return this._client.post(path`/v1/environments/${environment_id}/work/${workID}/ack?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #484a8673033c391b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:169 
    return this._client.post(path`/v1/environments/${environment_id}/work/${workID}/heartbeat?beta=true`, {
      query: { desired_ttl_seconds, expected_last_heartbeat },
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e2f45369140cfd54 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:201 
    return this._client.get(path`/v1/environments/${environmentID}/work/poll?beta=true`, {
      query,
      ...options,
      headers: buildHeaders([
        {
          'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString(),
          ...(anthropicWorkerID != null ? { 'Anthropic-Worker-ID': anthropicWorkerID } : undefined),
        },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8e99ba4d94eafb1e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:231 
    return this._client.get(path`/v1/environments/${environmentID}/work/stats?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #20a18621c1c17e2b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/environments/work.ts:258 
    return this._client.post(path`/v1/environments/${environment_id}/work/${workID}/stop?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d205fe843145d72d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/files.ts:85 
    return this._client.get(path`/v1/files/${fileID}/content?beta=true`, {
      ...options,
      headers: buildHeaders([
        {
          'anthropic-beta': [...(betas ?? []), 'files-api-2025-04-14'].toString(),
          Accept: 'application/binary',
        },
        options?.headers,
      ]),
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b47356af8743a87a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/files.ts:113 
    return this._client.get(path`/v1/files/${fileID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'files-api-2025-04-14'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a9977687140b1a69 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memories.ts:30 
    return this._client.post(path`/v1/memory_stores/${memoryStoreID}/memories?beta=true`, {
      query: { view },
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6bfbcbf547136a8a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memories.ts:59 
    return this._client.get(path`/v1/memory_stores/${memory_store_id}/memories/${memoryID}?beta=true`, {
      query,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #864a5067726c6d5e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memories.ts:87 
    return this._client.post(path`/v1/memory_stores/${memory_store_id}/memories/${memoryID}?beta=true`, {
      query: { view },
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #99c11f2a162da345 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-stores.ts:91 
    return this._client.get(path`/v1/memory_stores/${memoryStoreID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1249eebf8bcea6a3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-stores.ts:115 
    return this._client.post(path`/v1/memory_stores/${memoryStoreID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f0e46917e6ec6f01 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-stores.ts:190 
    return this._client.post(path`/v1/memory_stores/${memoryStoreID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1580533029ce7706 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-versions.ts:31 
    return this._client.get(
      path`/v1/memory_stores/${memory_store_id}/memory_versions/${memoryVersionID}?beta=true`,
      {
        query,
        ...options,
        headers: buildHeaders([
          { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
          options?.headers,
        ]),
      },
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #03e6a74593c300de — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/memory-stores/memory-versions.ts:95 
    return this._client.post(
      path`/v1/memory_stores/${memory_store_id}/memory_versions/${memoryVersionID}/redact?beta=true`,
      {
        ...options,
        headers: buildHeaders([
          { 'anthropic-beta': [...(betas ?? []), 'agent-memory-2026-07-22'].toString() },
          options?.headers,
        ]),
      },
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fa6c5bb80d4d425b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/messages/batches.ts:82 
    return this._client.get(path`/v1/messages/batches/${messageBatchID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1096d149d68e6b3e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/messages/batches.ts:181 
    return this._client.post(path`/v1/messages/batches/${messageBatchID}/cancel?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fdef8d5d5869b362 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/messages/batches.ts:221 
    return this._client
      .get(batch.results_url, {
        ...options,
        headers: buildHeaders([
          {
            'anthropic-beta': [...(betas ?? []), 'message-batches-2024-09-24'].toString(),
            Accept: 'application/binary',
          },
          options?.headers,
        ]),
        stream: true,
        __binaryResponse: true,
      })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #50bae3f8d71d4021 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/models.ts:31 
    return this._client.get(path`/v1/models/${modelID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d600c63f7e1b48da — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/events.ts:82 
    return this._client.post(path`/v1/sessions/${sessionID}/events?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2a09bbd2e516f607 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/events.ts:109 
    return this._client.get(path`/v1/sessions/${sessionID}/events/stream?beta=true`, {
      query,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
      stream: true,
    }) as APIPromise<Stream<BetaManagedAgentsStreamSessionEvents>>;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0b43113c5f36782e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/resources.ts:31 
    return this._client.get(path`/v1/sessions/${session_id}/resources/${resourceID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8886f34f3738eb5a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/resources.ts:61 
    return this._client.post(path`/v1/sessions/${session_id}/resources/${resourceID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #649aee3e2a410e87 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/resources.ts:152 
    return this._client.post(path`/v1/sessions/${sessionID}/resources?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #aab7bd1c73ebb641 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/sessions.ts:174 
    return this._client.get(path`/v1/sessions/${sessionID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ce2e5c65042883e7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/sessions.ts:200 
    return this._client.post(path`/v1/sessions/${sessionID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4979dbc01ee4e207 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/sessions.ts:283 
    return this._client.post(path`/v1/sessions/${sessionID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fb05fe680d155d2f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/threads/events.ts:68 
    return this._client.get(path`/v1/sessions/${session_id}/threads/${threadID}/stream?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
      stream: true,
    }) as APIPromise<Stream<ThreadsAPI.BetaManagedAgentsStreamSessionThreadEvents>>;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #69b26044d971eb2b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/threads/threads.ts:37 
    return this._client.get(path`/v1/sessions/${session_id}/threads/${threadID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2bb9116302aae35c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/sessions/threads/threads.ts:97 
    return this._client.post(path`/v1/sessions/${session_id}/threads/${threadID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0fb0d11d7e42d820 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/skills/skills.ts:73 
    return this._client.get(path`/v1/skills/${skillID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ce22b86b9dfc9ccd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/skills/versions.ts:31 
    return this._client.post(
      path`/v1/skills/${skillID}/versions?beta=true`,
      multipartFormRequestOptions(
        {
          body,
          ...options,
          headers: buildHeaders([
            { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
            options?.headers,
          ]),
        },
        this._client,
        false,
      ),
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0e96b85ab3b5a499 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/skills/versions.ts:65 
    return this._client.get(path`/v1/skills/${skill_id}/versions/${version}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #31b1172e769414e1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/skills/versions.ts:149 
    return this._client.get(path`/v1/skills/${skill_id}/versions/${version}/content?beta=true`, {
      ...options,
      headers: buildHeaders([
        {
          'anthropic-beta': [...(betas ?? []), 'skills-2025-10-02'].toString(),
          Accept: 'application/binary',
        },
        options?.headers,
      ]),
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f04c37e7363ad263 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/certificates.ts:37 
    return this._client.post(path`/v1/tunnels/${tunnelID}/certificates?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #430e5088103093dd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/certificates.ts:70 
    return this._client.get(path`/v1/tunnels/${tunnel_id}/certificates/${certificateID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #41cc4375107964c4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/certificates.ts:144 
    return this._client.post(path`/v1/tunnels/${tunnel_id}/certificates/${certificateID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #57a4af4ecc48f7f9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/tunnels.ts:72 
    return this._client.get(path`/v1/tunnels/${tunnelID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5447cbeebb00869e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/tunnels.ts:137 
    return this._client.post(path`/v1/tunnels/${tunnelID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a88aadc1abf97178 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/tunnels.ts:169 
    return this._client.post(path`/v1/tunnels/${tunnelID}/reveal_token?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9c5d52aa99f9154c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/tunnels/tunnels.ts:200 
    return this._client.post(path`/v1/tunnels/${tunnelID}/rotate_token?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'mcp-tunnels-2026-06-22'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #194fa40366766fa5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/user-profiles.ts:50 
    return this._client.get(path`/v1/user_profiles/${userProfileID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7561a4742a175f50 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/user-profiles.ts:76 
    return this._client.post(path`/v1/user_profiles/${userProfileID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6bcf9d6579058398 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/user-profiles.ts:129 
    return this._client.post(path`/v1/user_profiles/${userProfileID}/enrollment_url?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'user-profiles-2026-03-24'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5985fb82ab281599 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:37 
    return this._client.post(path`/v1/vaults/${vaultID}/credentials?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ab77982baa0ec9a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:65 
    return this._client.get(path`/v1/vaults/${vault_id}/credentials/${credentialID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5816993cf049a0a5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:92 
    return this._client.post(path`/v1/vaults/${vault_id}/credentials/${credentialID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f9a241d565532558 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:180 
    return this._client.post(path`/v1/vaults/${vault_id}/credentials/${credentialID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8115739029d14d4a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/credentials.ts:207 
    return this._client.post(
      path`/v1/vaults/${vault_id}/credentials/${credentialID}/mcp_oauth_validate?beta=true`,
      {
        ...options,
        headers: buildHeaders([
          { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
          options?.headers,
        ]),
      },
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b961dd16ffe586ca — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/vaults.ts:101 
    return this._client.get(path`/v1/vaults/${vaultID}?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ffe91d4b6accc254 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/vaults.ts:127 
    return this._client.post(path`/v1/vaults/${vaultID}?beta=true`, {
      body,
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d1aeedf675b146dc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/beta/vaults/vaults.ts:206 
    return this._client.post(path`/v1/vaults/${vaultID}/archive?beta=true`, {
      ...options,
      headers: buildHeaders([
        { 'anthropic-beta': [...(betas ?? []), 'managed-agents-2026-04-01'].toString() },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9a052b3934cc8039 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/messages/batches.ts:71 
    return this._client.get(path`/v1/messages/batches/${messageBatchID}`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #22ca1f308084ec92 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/messages/batches.ts:137 
    return this._client.post(path`/v1/messages/batches/${messageBatchID}/cancel`, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cb82b61d7d201651 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/messages/batches.ts:167 
    return this._client
      .get(batch.results_url, {
        ...options,
        headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
        stream: true,
        __binaryResponse: true,
      })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d90084ddcfc9fee4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/resources/models.ts:24 
    return this._client.get(path`/v1/models/${modelID}`, {
      ...options,
      headers: buildHeaders([
        { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
        options?.headers,
      ]),
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs tooling Excluded from app score unknown #903f045f6b08fe5f — Filesystem access.
pkgs/npm/@[email protected]/src/tools/agent-toolset/fs-util.ts:112 
    await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #fa77daf8050eeaea — Filesystem access.
pkgs/npm/@[email protected]/src/tools/agent-toolset/node.ts:457 
        data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1f39e13848cef9e2 — Filesystem access.
pkgs/npm/@[email protected]/src/tools/agent-toolset/node.ts:533 
        data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #984744a496ffc596 — Environment-variable access.
pkgs/npm/@[email protected]/src/tools/agent-toolset/node.ts:806 
  const dirs = (process.env['PATH'] ?? '').split(path.delimiter);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #2efdd2be9559ee15 — Filesystem access.
pkgs/npm/@[email protected]/src/tools/memory/node.ts:4 
import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d9a30281a03547df — Filesystem access.
pkgs/npm/@[email protected]/src/tools/memory/node.ts:52 
    await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7fd65e0cc4bbddca — Filesystem access.
pkgs/npm/@[email protected]/src/tools/memory/node.ts:101 
    return await fs.readFile(fullPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d9120b1af0ab9081 — Filesystem access.
pkgs/npm/@[email protected]/src/tools/memory/node.ts:256 
      await handle.writeFile(command.file_text, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #f5b818213149d479 — Filesystem access.
pkgs/npm/@[email protected]/tools/agent-toolset/fs-util.js:115 
        await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #8cc1e94a634abe38 — Filesystem access.
pkgs/npm/@[email protected]/tools/agent-toolset/fs-util.mjs:107 
        await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a191a43c45c6917a — Filesystem access.
pkgs/npm/@[email protected]/tools/agent-toolset/node.js:390 
                data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d7c381445ee90072 — Filesystem access.
pkgs/npm/@[email protected]/tools/agent-toolset/node.js:469 
                data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a16a85aeab01c3c6 — Environment-variable access.
pkgs/npm/@[email protected]/tools/agent-toolset/node.js:755 
    const dirs = (process.env['PATH'] ?? '').split(path.delimiter);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c58edb21c827dbc7 — Filesystem access.
pkgs/npm/@[email protected]/tools/agent-toolset/node.mjs:375 
                data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b6e1e9e1fee98339 — Filesystem access.
pkgs/npm/@[email protected]/tools/agent-toolset/node.mjs:454 
                data = await fs.readFile(abs, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d70ac221fc80b49e — Environment-variable access.
pkgs/npm/@[email protected]/tools/agent-toolset/node.mjs:740 
    const dirs = (process.env['PATH'] ?? '').split(path.delimiter);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #7d4ee8fec8e0cb84 — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.js:43 
        await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #82fb83f890536561 — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.js:91 
        return await fs.readFile(fullPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a3ea0a0ffad6f6ff — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.js:213 
            await handle.writeFile(command.file_text, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #dc7f456027d92be0 — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.mjs:2 
import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b0cb3afce56a5e8f — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.mjs:38 
        await handle.writeFile(content, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #891fce4353aee769 — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.mjs:86 
        return await fs.readFile(fullPath, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ae6eb1594a9f0208 — Filesystem access.
pkgs/npm/@[email protected]/tools/memory/node.mjs:208 
            await handle.writeFile(command.file_text, 'utf-8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

openai

npm dependency
medium pii_flow dependency Excluded from app score #65cc4f5f9e2aa7a5 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/[email protected]/auth/workload-identity-auth.js:53 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/[email protected]/auth/workload-identity-auth.js:46 → /tmp/closeopen-jglvjeb9/pkgs/npm/[email protected]/auth/workload-identity-auth.js:53 
        const response = await this.fetch(this.tokenExchangeUrl, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
            },
            body: JSON.stringify(body),
        });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow dependency Excluded from app score #c0cfe5c64dce04f7 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/[email protected]/auth/workload-identity-auth.mjs:49 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/[email protected]/auth/workload-identity-auth.mjs:42 → /tmp/closeopen-jglvjeb9/pkgs/npm/[email protected]/auth/workload-identity-auth.mjs:49 
        const response = await this.fetch(this.tokenExchangeUrl, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
            },
            body: JSON.stringify(body),
        });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
medium pii_flow dependency Excluded from app score #c2062b2201f15ac7 — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/[email protected]/src/auth/workload-identity-auth.ts:69 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/[email protected]/src/auth/workload-identity-auth.ts:60 → /tmp/closeopen-jglvjeb9/pkgs/npm/[email protected]/src/auth/workload-identity-auth.ts:69 
    const response = await this.fetch(this.tokenExchangeUrl, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
      },
      body: JSON.stringify(body),
    });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
expand_more 363 low-confidence finding(s)
low egress dependency Excluded from app score #c0cd7044c2bdd3ce — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/auth/subject-token-providers.js:50 
            const url = new URL(AZURE_IMDS_BASE_URL);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #072e72d54c0055be — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/auth/subject-token-providers.js:97 
            const url = new URL(`http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity`);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #491327f34727a1d4 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/auth/subject-token-providers.mjs:44 
            const url = new URL(AZURE_IMDS_BASE_URL);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c13f0aa3a8894794 — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/auth/subject-token-providers.mjs:91 
            const url = new URL(`http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity`);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #8039e14e87af3d95 — Environment-variable access.
pkgs/npm/[email protected]/azure.js:44 
                endpoint = process.env['AZURE_OPENAI_ENDPOINT'];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #07bc8b40b565895f — Environment-variable access.
pkgs/npm/[email protected]/azure.mjs:40 
                endpoint = process.env['AZURE_OPENAI_ENDPOINT'];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #0b945784c9af3414 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/admin-api-keys.js:39 
        return this._client.get((0, path_1.path) `/organization/admin_api_keys/${keyID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #86fb02eeece473b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/admin-api-keys.mjs:36 
        return this._client.get(path `/organization/admin_api_keys/${keyID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #392b3031d03c9f24 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/certificates.js:44 
        return this._client.get((0, path_1.path) `/organization/certificates/${certificateID}`, {
            query,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #828570d6dc0e4391 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/certificates.js:62 
        return this._client.post((0, path_1.path) `/organization/certificates/${certificateID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #79cbeaccef956726 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/certificates.mjs:41 
        return this._client.get(path `/organization/certificates/${certificateID}`, {
            query,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c7db73c898dade77 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/certificates.mjs:59 
        return this._client.post(path `/organization/certificates/${certificateID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2b2b171c2c4f9735 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/groups/groups.js:48 
        return this._client.get((0, path_1.path) `/organization/groups/${groupID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0d3ada239ec860e6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/groups/groups.js:65 
        return this._client.post((0, path_1.path) `/organization/groups/${groupID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d57858f61dd23f11 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/groups/groups.mjs:44 
        return this._client.get(path `/organization/groups/${groupID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fd0c14bd14f92a9d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/groups/groups.mjs:61 
        return this._client.post(path `/organization/groups/${groupID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d999e6cb545722b7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/groups/roles.js:22 
        return this._client.post((0, path_1.path) `/organization/groups/${groupID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d3f086685db28c31 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/groups/roles.js:42 
        return this._client.get((0, path_1.path) `/organization/groups/${group_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #49207dec86ee1593 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/groups/roles.mjs:19 
        return this._client.post(path `/organization/groups/${groupID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1e2df5a13987e613 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/groups/roles.mjs:39 
        return this._client.get(path `/organization/groups/${group_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c24b92a1a2df2219 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/groups/users.js:22 
        return this._client.post((0, path_1.path) `/organization/groups/${groupID}/users`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #13ccd15b3f5e1896 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/groups/users.js:42 
        return this._client.get((0, path_1.path) `/organization/groups/${group_id}/users/${userID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cd142d940b320cf6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/groups/users.mjs:19 
        return this._client.post(path `/organization/groups/${groupID}/users`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #852128857173edb2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/groups/users.mjs:39 
        return this._client.get(path `/organization/groups/${group_id}/users/${userID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ac6260175d49f6ca — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/invites.js:41 
        return this._client.get((0, path_1.path) `/organization/invites/${inviteID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #96556f52230bae0b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/invites.mjs:38 
        return this._client.get(path `/organization/invites/${inviteID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6a1904c3367c3781 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/api-keys.js:23 
        return this._client.get((0, path_1.path) `/organization/projects/${project_id}/api_keys/${apiKeyID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2a13f13a61f4dab2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/api-keys.mjs:20 
        return this._client.get(path `/organization/projects/${project_id}/api_keys/${apiKeyID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ab288d828c25b0ee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/data-retention.js:20 
        return this._client.get((0, path_1.path) `/organization/projects/${projectID}/data_retention`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ee150c816e598887 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/data-retention.js:38 
        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/data_retention`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6681f347958f7fc7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/data-retention.mjs:17 
        return this._client.get(path `/organization/projects/${projectID}/data_retention`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6c98617bd8e422e5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/data-retention.mjs:35 
        return this._client.post(path `/organization/projects/${projectID}/data_retention`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3f1447fcde851822 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/groups.js:29 
        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/groups`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e378331415449195 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/groups.js:49 
        return this._client.get((0, path_1.path) `/organization/projects/${project_id}/groups/${groupID}`, {
            query,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #31631a63d95c56c6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/groups.mjs:25 
        return this._client.post(path `/organization/projects/${projectID}/groups`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ff6e4b54788926a7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/groups.mjs:45 
        return this._client.get(path `/organization/projects/${project_id}/groups/${groupID}`, {
            query,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a4b1ab71ecd0eaaa — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/roles.js:23 
        return this._client.post((0, path_1.path) `/projects/${project_id}/groups/${groupID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e6aaf55f1072a303 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/roles.js:43 
        return this._client.get((0, path_1.path) `/projects/${project_id}/groups/${group_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #929357a03a36188a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/roles.mjs:20 
        return this._client.post(path `/projects/${project_id}/groups/${groupID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d7e937707cff207a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/groups/roles.mjs:40 
        return this._client.get(path `/projects/${project_id}/groups/${group_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e73b9d2eda4f3806 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/hosted-tool-permissions.js:20 
        return this._client.get((0, path_1.path) `/organization/projects/${projectID}/hosted_tool_permissions`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #03e6fb965602e752 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/hosted-tool-permissions.js:37 
        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/hosted_tool_permissions`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #93455697d151c7bd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/hosted-tool-permissions.mjs:17 
        return this._client.get(path `/organization/projects/${projectID}/hosted_tool_permissions`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ddee99426243cfb6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/hosted-tool-permissions.mjs:34 
        return this._client.post(path `/organization/projects/${projectID}/hosted_tool_permissions`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5e11c83ad0e70650 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/model-permissions.js:20 
        return this._client.get((0, path_1.path) `/organization/projects/${projectID}/model_permissions`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e3b17dc9fb2878e2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/model-permissions.js:38 
        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/model_permissions`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #932d41cea8ea971f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/model-permissions.mjs:17 
        return this._client.get(path `/organization/projects/${projectID}/model_permissions`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #043da8bcc43f2f15 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/model-permissions.mjs:35 
        return this._client.post(path `/organization/projects/${projectID}/model_permissions`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #574d0b0175f44146 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/projects.js:77 
        return this._client.get((0, path_1.path) `/organization/projects/${projectID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8c1eb94e67c434f9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/projects.js:94 
        return this._client.post((0, path_1.path) `/organization/projects/${projectID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #eabe30b4c7832894 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/projects.js:131 
        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/archive`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d64ec4ccb1f0c24a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/projects.mjs:73 
        return this._client.get(path `/organization/projects/${projectID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #de38dcdafb508466 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/projects.mjs:90 
        return this._client.post(path `/organization/projects/${projectID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6140e5f36e4cd3c6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/projects.mjs:127 
        return this._client.post(path `/organization/projects/${projectID}/archive`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #469458eba48aa7c1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/rate-limits.js:39 
        return this._client.post((0, path_1.path) `/organization/projects/${project_id}/rate_limits/${rateLimitID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8dc2932b32cfc201 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/rate-limits.mjs:36 
        return this._client.post(path `/organization/projects/${project_id}/rate_limits/${rateLimitID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5ee4485a0bb55f7a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/roles.js:22 
        return this._client.post((0, path_1.path) `/projects/${projectID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1ba126634d26a9c7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/roles.js:42 
        return this._client.get((0, path_1.path) `/projects/${project_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #14e84177e3e38421 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/roles.js:61 
        return this._client.post((0, path_1.path) `/projects/${project_id}/roles/${roleID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fc6a05cdbaed5e67 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/roles.mjs:19 
        return this._client.post(path `/projects/${projectID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0fef87a0e2f24e11 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/roles.mjs:39 
        return this._client.get(path `/projects/${project_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #95aa2e3b8cec4da1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/roles.mjs:58 
        return this._client.post(path `/projects/${project_id}/roles/${roleID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5c643763bc3ba984 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/api-keys.js:22 
        return this._client.post((0, path_1.path) `/organization/projects/${project_id}/service_accounts/${serviceAccountID}/api_keys`, { body, ...options, __security: { adminAPIKeyAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #001024324cedbce5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/api-keys.mjs:19 
        return this._client.post(path `/organization/projects/${project_id}/service_accounts/${serviceAccountID}/api_keys`, { body, ...options, __security: { adminAPIKeyAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b27ed7e83ba82e20 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.js:30 
        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/service_accounts`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9bd8b3e2b479c428 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.js:50 
        return this._client.get((0, path_1.path) `/organization/projects/${project_id}/service_accounts/${serviceAccountID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e1bb23b2da6d5a6f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.js:69 
        return this._client.post((0, path_1.path) `/organization/projects/${project_id}/service_accounts/${serviceAccountID}`, { body, ...options, __security: { adminAPIKeyAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c19f453a7654ef02 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.mjs:26 
        return this._client.post(path `/organization/projects/${projectID}/service_accounts`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #669d64972b1dca32 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.mjs:46 
        return this._client.get(path `/organization/projects/${project_id}/service_accounts/${serviceAccountID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #53fd0895eeaec735 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/service-accounts/service-accounts.mjs:65 
        return this._client.post(path `/organization/projects/${project_id}/service_accounts/${serviceAccountID}`, { body, ...options, __security: { adminAPIKeyAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #22345486e4e044a4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.js:30 
        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/spend_alerts`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7624b75a77444bcf — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.js:50 
        return this._client.get((0, path_1.path) `/organization/projects/${project_id}/spend_alerts/${alertID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c3b8f7e0ca6698e6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.js:78 
        return this._client.post((0, path_1.path) `/organization/projects/${project_id}/spend_alerts/${alertID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #41d7f83cbce2c5bd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.mjs:27 
        return this._client.post(path `/organization/projects/${projectID}/spend_alerts`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fb816fe8c8fc312c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.mjs:47 
        return this._client.get(path `/organization/projects/${project_id}/spend_alerts/${alertID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1803fd5130f816e8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/spend-alerts.mjs:75 
        return this._client.post(path `/organization/projects/${project_id}/spend_alerts/${alertID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #30b517b890e46868 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/users/roles.js:23 
        return this._client.post((0, path_1.path) `/projects/${project_id}/users/${userID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3bff9cc8867e69a3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/users/roles.js:43 
        return this._client.get((0, path_1.path) `/projects/${project_id}/users/${user_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3959171768f8437c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/users/roles.mjs:20 
        return this._client.post(path `/projects/${project_id}/users/${userID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4f06c3f6e481d4a4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/users/roles.mjs:40 
        return this._client.get(path `/projects/${project_id}/users/${user_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #99f6b25c3458ed31 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.js:30 
        return this._client.post((0, path_1.path) `/organization/projects/${projectID}/users`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5763bfbe4afeaeb5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.js:50 
        return this._client.get((0, path_1.path) `/organization/projects/${project_id}/users/${userID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #56d4408d39b16f10 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.js:69 
        return this._client.post((0, path_1.path) `/organization/projects/${project_id}/users/${userID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #23de28bddbdc2b1e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.mjs:26 
        return this._client.post(path `/organization/projects/${projectID}/users`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1a93ef21acfcb423 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.mjs:46 
        return this._client.get(path `/organization/projects/${project_id}/users/${userID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5d6c090f919fe64c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/projects/users/users.mjs:65 
        return this._client.post(path `/organization/projects/${project_id}/users/${userID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #348f04a47491fd2c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/roles.js:38 
        return this._client.get((0, path_1.path) `/organization/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #69f905b0098f877d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/roles.js:54 
        return this._client.post((0, path_1.path) `/organization/roles/${roleID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d1344be427cb8652 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/roles.mjs:35 
        return this._client.get(path `/organization/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #12aabfcb4266e995 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/roles.mjs:51 
        return this._client.post(path `/organization/roles/${roleID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4ddce8e4beb59af5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/spend-alerts.js:45 
        return this._client.get((0, path_1.path) `/organization/spend_alerts/${alertID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3496c10fb461e1d3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/spend-alerts.js:71 
        return this._client.post((0, path_1.path) `/organization/spend_alerts/${alertID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #20a595090078db8b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/spend-alerts.mjs:42 
        return this._client.get(path `/organization/spend_alerts/${alertID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5ebb226013d5b2ef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/spend-alerts.mjs:68 
        return this._client.post(path `/organization/spend_alerts/${alertID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0c164bb1d2105eb8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/users/roles.js:22 
        return this._client.post((0, path_1.path) `/organization/users/${userID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e78ae4cbefadf55c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/users/roles.js:42 
        return this._client.get((0, path_1.path) `/organization/users/${user_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7e701fe12ef5142c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/users/roles.mjs:19 
        return this._client.post(path `/organization/users/${userID}/roles`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f0239c1ab9ddb492 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/users/roles.mjs:39 
        return this._client.get(path `/organization/users/${user_id}/roles/${roleID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #62f1ffa4932e3249 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/users/users.js:26 
        return this._client.get((0, path_1.path) `/organization/users/${userID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7002c1c1dfa87409 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/users/users.js:41 
        return this._client.post((0, path_1.path) `/organization/users/${userID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6225807d7830576a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/users/users.mjs:22 
        return this._client.get(path `/organization/users/${userID}`, {
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8fca049f908b26d5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/admin/organization/users/users.mjs:37 
        return this._client.post(path `/organization/users/${userID}`, {
            body,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f9ac36a16971f4c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/batches.js:22 
        return this._client.get((0, path_1.path) `/batches/${batchID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9ea3f122b4c20fea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/batches.js:40 
        return this._client.post((0, path_1.path) `/batches/${batchID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dbbffff49786b980 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/batches.mjs:19 
        return this._client.get(path `/batches/${batchID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f8a51cdd7d7d6d63 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/batches.mjs:37 
        return this._client.post(path `/batches/${batchID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b14df8c6bf747785 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/assistants.js:32 
        return this._client.get((0, path_1.path) `/assistants/${assistantID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cfcb94606206f046 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/assistants.js:44 
        return this._client.post((0, path_1.path) `/assistants/${assistantID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3b8a904c615b9bee — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/assistants.mjs:29 
        return this._client.get(path `/assistants/${assistantID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #125a949c956a5b10 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/assistants.mjs:41 
        return this._client.post(path `/assistants/${assistantID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a86c629b05317371 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/chatkit/sessions.js:41 
        return this._client.post((0, path_1.path) `/chatkit/sessions/${sessionID}/cancel`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2bcc8599f230e8b9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/chatkit/sessions.mjs:38 
        return this._client.post(path `/chatkit/sessions/${sessionID}/cancel`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e9ca802e72c236f4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/chatkit/threads.js:20 
        return this._client.get((0, path_1.path) `/chatkit/threads/${threadID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d5d0f471b6e9695b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/chatkit/threads.mjs:17 
        return this._client.get(path `/chatkit/threads/${threadID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ad01eb3cee92b672 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/responses/responses.js:34 
        return this._client.get((0, path_1.path) `/responses/${responseID}?beta=true`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { ...(betas?.toString() != null ? { 'openai-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
            stream: params?.stream ?? false,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #831d0f93b3dbf700 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/responses/responses.js:80 
        return this._client.post((0, path_1.path) `/responses/${responseID}/cancel?beta=true`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([
                { ...(betas?.toString() != null ? { 'openai-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #200c824b49d12867 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/responses/responses.mjs:30 
        return this._client.get(path `/responses/${responseID}?beta=true`, {
            query,
            ...options,
            headers: buildHeaders([
                { ...(betas?.toString() != null ? { 'openai-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
            stream: params?.stream ?? false,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #801cb86c4448f617 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/responses/responses.mjs:76 
        return this._client.post(path `/responses/${responseID}/cancel?beta=true`, {
            ...options,
            headers: buildHeaders([
                { ...(betas?.toString() != null ? { 'openai-beta': betas?.toString() } : undefined) },
                options?.headers,
            ]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0a70d3f74de1f6e6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/messages.js:21 
        return this._client.post((0, path_1.path) `/threads/${threadID}/messages`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d2c030183f1d1557 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/messages.js:35 
        return this._client.get((0, path_1.path) `/threads/${thread_id}/messages/${messageID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d0eb8d096d7a489d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/messages.js:48 
        return this._client.post((0, path_1.path) `/threads/${thread_id}/messages/${messageID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e8ea5434b341adac — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/messages.mjs:18 
        return this._client.post(path `/threads/${threadID}/messages`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #afaf8466cc262728 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/messages.mjs:32 
        return this._client.get(path `/threads/${thread_id}/messages/${messageID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0bf32832c1de600d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/messages.mjs:45 
        return this._client.post(path `/threads/${thread_id}/messages/${messageID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1e236f8a96f9df1b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:26 
        return this._client.post((0, path_1.path) `/threads/${threadID}/runs`, {
            query: { include },
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            stream: params.stream ?? false,
            __synthesizeEventData: true,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fa400d57e4035178 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:43 
        return this._client.get((0, path_1.path) `/threads/${thread_id}/runs/${runID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #66b6b5012641c043 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:56 
        return this._client.post((0, path_1.path) `/threads/${thread_id}/runs/${runID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3835eb2b828b7ada — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:83 
        return this._client.post((0, path_1.path) `/threads/${thread_id}/runs/${runID}/cancel`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #541b42b7145484b8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.js:163 
        return this._client.post((0, path_1.path) `/threads/${thread_id}/runs/${runID}/submit_tool_outputs`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            stream: params.stream ?? false,
            __synthesizeEventData: true,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #66858591c290caa1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:22 
        return this._client.post(path `/threads/${threadID}/runs`, {
            query: { include },
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            stream: params.stream ?? false,
            __synthesizeEventData: true,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #570a77f7b0247940 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:39 
        return this._client.get(path `/threads/${thread_id}/runs/${runID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dea03e95073c905c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:52 
        return this._client.post(path `/threads/${thread_id}/runs/${runID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a9392d01b149e116 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:79 
        return this._client.post(path `/threads/${thread_id}/runs/${runID}/cancel`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1886d1612115eeeb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/runs.mjs:159 
        return this._client.post(path `/threads/${thread_id}/runs/${runID}/submit_tool_outputs`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            stream: params.stream ?? false,
            __synthesizeEventData: true,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1dbab0dff7d5eed6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/steps.js:22 
        return this._client.get((0, path_1.path) `/threads/${thread_id}/runs/${run_id}/steps/${stepID}`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1dab5ec69db85870 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/runs/steps.mjs:19 
        return this._client.get(path `/threads/${thread_id}/runs/${run_id}/steps/${stepID}`, {
            query,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e095a74b4fdbcfeb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/threads.js:44 
        return this._client.get((0, path_1.path) `/threads/${threadID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cc619a8873ff8fb5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/threads.js:56 
        return this._client.post((0, path_1.path) `/threads/${threadID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9b1297e3b695ee2c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/threads.mjs:40 
        return this._client.get(path `/threads/${threadID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #256ef81b6c13b232 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/beta/threads/threads.mjs:52 
        return this._client.post(path `/threads/${threadID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0cf5abc829593fa7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/chat/completions/completions.js:42 
        return this._client.get((0, path_1.path) `/chat/completions/${completionID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3d6fa7799b465128 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/chat/completions/completions.js:61 
        return this._client.post((0, path_1.path) `/chat/completions/${completionID}`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #26bc4b15eaa9d195 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/chat/completions/completions.mjs:38 
        return this._client.get(path `/chat/completions/${completionID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5c276a5a32f6a307 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/chat/completions/completions.mjs:57 
        return this._client.post(path `/chat/completions/${completionID}`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #42245595b41a4162 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/containers.js:27 
        return this._client.get((0, path_1.path) `/containers/${containerID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #840858d478229a40 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/containers.mjs:23 
        return this._client.get(path `/containers/${containerID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8d7e4dc4e3efa919 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/files/content.js:14 
        return this._client.get((0, path_1.path) `/containers/${container_id}/files/${fileID}/content`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7dece79bf6e7734e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/files/content.mjs:11 
        return this._client.get(path `/containers/${container_id}/files/${fileID}/content`, {
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2a5392008e3391ba — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/files/files.js:25 
        return this._client.post((0, path_1.path) `/containers/${containerID}/files`, (0, uploads_1.maybeMultipartFormRequestOptions)({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8eaffec56c60a3a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/files/files.js:32 
        return this._client.get((0, path_1.path) `/containers/${container_id}/files/${fileID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #107b247b51bf7584 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/files/files.mjs:21 
        return this._client.post(path `/containers/${containerID}/files`, maybeMultipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ca6fb8b4638badef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/containers/files/files.mjs:28 
        return this._client.get(path `/containers/${container_id}/files/${fileID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fa3b2926cccdd49e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/conversations.js:28 
        return this._client.get((0, path_1.path) `/conversations/${conversationID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b96d584fb799e971 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/conversations.js:37 
        return this._client.post((0, path_1.path) `/conversations/${conversationID}`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #beca2fde4e3ab79c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/conversations.mjs:24 
        return this._client.get(path `/conversations/${conversationID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #21436dcce4037b7a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/conversations.mjs:33 
        return this._client.post(path `/conversations/${conversationID}`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0988616efd2a1763 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/items.js:17 
        return this._client.post((0, path_1.path) `/conversations/${conversationID}/items`, {
            query: { include },
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #75c0a6a308885097 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/items.js:29 
        return this._client.get((0, path_1.path) `/conversations/${conversation_id}/items/${itemID}`, {
            query,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #521840393b608c83 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/items.mjs:14 
        return this._client.post(path `/conversations/${conversationID}/items`, {
            query: { include },
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #641d4f8c50ed542f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/conversations/items.mjs:26 
        return this._client.get(path `/conversations/${conversation_id}/items/${itemID}`, {
            query,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #fbfbe3c8994d1a3e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/evals.js:34 
        return this._client.get((0, path_1.path) `/evals/${evalID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #bd0a3c9c3d464ce7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/evals.js:40 
        return this._client.post((0, path_1.path) `/evals/${evalID}`, { body, ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #c8776ddd3358c702 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/evals.mjs:30 
        return this._client.get(path `/evals/${evalID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #1965b8cf80e392fd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/evals.mjs:36 
        return this._client.post(path `/evals/${evalID}`, { body, ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #3248ccb3912b06f2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/output-items.js:17 
        return this._client.get((0, path_1.path) `/evals/${eval_id}/runs/${run_id}/output_items/${outputItemID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #462f173be61997a6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/output-items.mjs:14 
        return this._client.get(path `/evals/${eval_id}/runs/${run_id}/output_items/${outputItemID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #f3c7b42a521a7ee3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/runs.js:25 
        return this._client.post((0, path_1.path) `/evals/${evalID}/runs`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #e6bf0234cf4ac02f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/runs.js:36 
        return this._client.get((0, path_1.path) `/evals/${eval_id}/runs/${runID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #6f00b2ace9c104da — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/runs.js:66 
        return this._client.post((0, path_1.path) `/evals/${eval_id}/runs/${runID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #dea01dae38c33b1a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/runs.mjs:21 
        return this._client.post(path `/evals/${evalID}/runs`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #0152072c1edc0bf6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/runs.mjs:32 
        return this._client.get(path `/evals/${eval_id}/runs/${runID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #8c6d0a4faaaa3965 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/evals/runs/runs.mjs:62 
        return this._client.post(path `/evals/${eval_id}/runs/${runID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #943b243c495532ef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/files.js:52 
        return this._client.get((0, path_1.path) `/files/${fileID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #121abd25ce2c4709 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/files.js:74 
        return this._client.get((0, path_1.path) `/files/${fileID}/content`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5421f04ac3924fc0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/files.mjs:49 
        return this._client.get(path `/files/${fileID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6f7ef09d04922608 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/files.mjs:71 
        return this._client.get(path `/files/${fileID}/content`, {
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c58ad0b2417f4129 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/checkpoints/permissions.js:41 
        return this._client.get((0, path_1.path) `/fine_tuning/checkpoints/${fineTunedModelCheckpoint}/permissions`, {
            query,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #263a52a5d232c528 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/checkpoints/permissions.mjs:38 
        return this._client.get(path `/fine_tuning/checkpoints/${fineTunedModelCheckpoint}/permissions`, {
            query,
            ...options,
            __security: { adminAPIKeyAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0ef022db292000b8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:52 
        return this._client.get((0, path_1.path) `/fine_tuning/jobs/${fineTuningJobID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2326348e57c70f1b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:86 
        return this._client.post((0, path_1.path) `/fine_tuning/jobs/${fineTuningJobID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e37634523035bcf2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:118 
        return this._client.post((0, path_1.path) `/fine_tuning/jobs/${fineTuningJobID}/pause`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a64b6033d42cd48d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.js:134 
        return this._client.post((0, path_1.path) `/fine_tuning/jobs/${fineTuningJobID}/resume`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d9c70acc5a49b5b8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:48 
        return this._client.get(path `/fine_tuning/jobs/${fineTuningJobID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #18cbf89b35e1488c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:82 
        return this._client.post(path `/fine_tuning/jobs/${fineTuningJobID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8991dd230bebb55c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:114 
        return this._client.post(path `/fine_tuning/jobs/${fineTuningJobID}/pause`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0b8ea247bfba5003 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/fine-tuning/jobs/jobs.mjs:130 
        return this._client.post(path `/fine_tuning/jobs/${fineTuningJobID}/resume`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #607f7db3b7b2106e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/models.js:17 
        return this._client.get((0, path_1.path) `/models/${model}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #63899797c5a91549 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/models.mjs:14 
        return this._client.get(path `/models/${model}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #83be87f1ac30fab8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.js:21 
        return this._client.post((0, path_1.path) `/realtime/calls/${callID}/accept`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ee7c02fe4c716ddd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.js:37 
        return this._client.post((0, path_1.path) `/realtime/calls/${callID}/hangup`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1ecd8bf0dfc8f100 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.js:54 
        return this._client.post((0, path_1.path) `/realtime/calls/${callID}/refer`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8ec6caced02465e3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.js:70 
        return this._client.post((0, path_1.path) `/realtime/calls/${callID}/reject`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #04666cdefb025fe3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.mjs:18 
        return this._client.post(path `/realtime/calls/${callID}/accept`, {
            body,
            ...options,
            headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #66e5d5a334a4b537 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.mjs:34 
        return this._client.post(path `/realtime/calls/${callID}/hangup`, {
            ...options,
            headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8babd527d8df8eba — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.mjs:51 
        return this._client.post(path `/realtime/calls/${callID}/refer`, {
            body,
            ...options,
            headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #017b23d05fa7e736 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/realtime/calls.mjs:67 
        return this._client.post(path `/realtime/calls/${callID}/reject`, {
            body,
            ...options,
            headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9ee7a6f7be69ef27 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/responses/responses.js:35 
        return this._client.get((0, path_1.path) `/responses/${responseID}`, {
            query,
            ...options,
            stream: query?.stream ?? false,
            __security: { bearerAuth: true },
        })._thenUnwrap((rsp) => {

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #166959e5f4c134ec — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/responses/responses.js:88 
        return this._client.post((0, path_1.path) `/responses/${responseID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #02730873592fabb7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/responses/responses.mjs:31 
        return this._client.get(path `/responses/${responseID}`, {
            query,
            ...options,
            stream: query?.stream ?? false,
            __security: { bearerAuth: true },
        })._thenUnwrap((rsp) => {

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1a4905a1e6d7096b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/responses/responses.mjs:84 
        return this._client.post(path `/responses/${responseID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #987b5a54a345b3bd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/skills/content.js:13 
        return this._client.get((0, path_1.path) `/skills/${skillID}/content`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0ec765e3ae5f2293 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/skills/content.mjs:10 
        return this._client.get(path `/skills/${skillID}/content`, {
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0991109e6509c259 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/skills/skills.js:30 
        return this._client.get((0, path_1.path) `/skills/${skillID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1b73126caa4190d7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/skills/skills.js:36 
        return this._client.post((0, path_1.path) `/skills/${skillID}`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1f87a97b6527bb03 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/skills/skills.mjs:26 
        return this._client.get(path `/skills/${skillID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b147f6cca8c0465b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/skills/skills.mjs:32 
        return this._client.post(path `/skills/${skillID}`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a6a9baef1c1bbcfb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/skills/versions/content.js:14 
        return this._client.get((0, path_1.path) `/skills/${skill_id}/versions/${version}/content`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b0708495d0670965 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/skills/versions/content.mjs:11 
        return this._client.get(path `/skills/${skill_id}/versions/${version}/content`, {
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d91a54ef4f2c2b95 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/skills/versions/versions.js:21 
        return this._client.post((0, path_1.path) `/skills/${skillID}/versions`, (0, uploads_1.maybeMultipartFormRequestOptions)({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a2a1283746a2985b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/skills/versions/versions.js:28 
        return this._client.get((0, path_1.path) `/skills/${skill_id}/versions/${version}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a2e3c90a9ef04890 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/skills/versions/versions.mjs:17 
        return this._client.post(path `/skills/${skillID}/versions`, maybeMultipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #af5ad56b6e9e3784 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/skills/versions/versions.mjs:24 
        return this._client.get(path `/skills/${skill_id}/versions/${version}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #89d793301e7ab26c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/uploads/parts.js:26 
        return this._client.post((0, path_1.path) `/uploads/${uploadID}/parts`, (0, uploads_1.multipartFormRequestOptions)({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4db6ff62737d78f6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/uploads/parts.mjs:23 
        return this._client.post(path `/uploads/${uploadID}/parts`, multipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #426883d564f3e15b — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/uploads/uploads.js:50 
        return this._client.post((0, path_1.path) `/uploads/${uploadID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d33012589072b15f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/uploads/uploads.js:73 
        return this._client.post((0, path_1.path) `/uploads/${uploadID}/complete`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #475c16e088f09941 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/uploads/uploads.mjs:46 
        return this._client.post(path `/uploads/${uploadID}/cancel`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1ceb86400f7519d0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/uploads/uploads.mjs:69 
        return this._client.post(path `/uploads/${uploadID}/complete`, {
            body,
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a6f7e782d4bc4353 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/file-batches.js:16 
        return this._client.post((0, path_1.path) `/vector_stores/${vectorStoreID}/file_batches`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #63541c308f5e59b4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/file-batches.js:28 
        return this._client.get((0, path_1.path) `/vector_stores/${vector_store_id}/file_batches/${batchID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #68dff0d58d013b87 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/file-batches.js:40 
        return this._client.post((0, path_1.path) `/vector_stores/${vector_store_id}/file_batches/${batchID}/cancel`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7a6150b510db4213 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/file-batches.mjs:13 
        return this._client.post(path `/vector_stores/${vectorStoreID}/file_batches`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e1800937fc50f4c8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/file-batches.mjs:25 
        return this._client.get(path `/vector_stores/${vector_store_id}/file_batches/${batchID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #25954924504bea20 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/file-batches.mjs:37 
        return this._client.post(path `/vector_stores/${vector_store_id}/file_batches/${batchID}/cancel`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7fb849799eb56f7e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/files.js:17 
        return this._client.post((0, path_1.path) `/vector_stores/${vectorStoreID}/files`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #23fe0a5cc2456e92 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/files.js:29 
        return this._client.get((0, path_1.path) `/vector_stores/${vector_store_id}/files/${fileID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4837b9b783f2e42d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/files.js:40 
        return this._client.post((0, path_1.path) `/vector_stores/${vector_store_id}/files/${fileID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #65f46ae4652fab06 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/files.mjs:14 
        return this._client.post(path `/vector_stores/${vectorStoreID}/files`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a0e82f58c2dbdad8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/files.mjs:26 
        return this._client.get(path `/vector_stores/${vector_store_id}/files/${fileID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fe63fdfe240563c5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/files.mjs:37 
        return this._client.post(path `/vector_stores/${vector_store_id}/files/${fileID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d5e745799333d57a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/vector-stores.js:35 
        return this._client.get((0, path_1.path) `/vector_stores/${vectorStoreID}`, {
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1733331c26df7311 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/vector-stores.js:45 
        return this._client.post((0, path_1.path) `/vector_stores/${vectorStoreID}`, {
            body,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dbab8dac4f8c60c5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/vector-stores.mjs:31 
        return this._client.get(path `/vector_stores/${vectorStoreID}`, {
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bd6b3e259aa21155 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/vector-stores/vector-stores.mjs:41 
        return this._client.post(path `/vector_stores/${vectorStoreID}`, {
            body,
            ...options,
            headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #73422cabbb5fae5e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.js:21 
        return this._client.get((0, path_1.path) `/videos/${videoID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d8f493a6fef4b9d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.js:51 
        return this._client.get((0, path_1.path) `/videos/${videoID}/content`, {
            query,
            ...options,
            headers: (0, headers_1.buildHeaders)([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e7b5c2c79d74f446 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.js:76 
        return this._client.get((0, path_1.path) `/videos/characters/${characterID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ec66bbb1c2c71878 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.js:85 
        return this._client.post((0, path_1.path) `/videos/${videoID}/remix`, (0, uploads_1.maybeMultipartFormRequestOptions)({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b5171c3299fe4f13 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.mjs:18 
        return this._client.get(path `/videos/${videoID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0d9f9737662c8aef — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.mjs:48 
        return this._client.get(path `/videos/${videoID}/content`, {
            query,
            ...options,
            headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
            __security: { bearerAuth: true },
            __binaryResponse: true,
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3fa0fe723a69a6cb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.mjs:73 
        return this._client.get(path `/videos/characters/${characterID}`, {
            ...options,
            __security: { bearerAuth: true },
        });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2e4fb9eee286f5e9 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/resources/videos.mjs:82 
        return this._client.post(path `/videos/${videoID}/remix`, maybeMultipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client));

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d115b159cfa09a7a — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/auth/subject-token-providers.ts:81 
      const url = new URL(AZURE_IMDS_BASE_URL);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cf3572c9cdd5936c — Hardcoded external endpoint. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/auth/subject-token-providers.ts:145 
      const url = new URL(
        `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity`,
      );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #ab940e6c4588e978 — Environment-variable access.
pkgs/npm/[email protected]/src/azure.ts:101 
        endpoint = process.env['AZURE_OPENAI_ENDPOINT'];

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #2a8dac3ea0e09950 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/admin-api-keys.ts:41 
    return this._client.get(path`/organization/admin_api_keys/${keyID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4675075d80e7f522 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/certificates.ts:55 
    return this._client.get(path`/organization/certificates/${certificateID}`, {
      query,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #dc76e4f4024381e3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/certificates.ts:78 
    return this._client.post(path`/organization/certificates/${certificateID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8d27b347ea950a40 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/groups/groups.ts:69 
    return this._client.get(path`/organization/groups/${groupID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #853da1de2f1aeeb5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/groups/groups.ts:91 
    return this._client.post(path`/organization/groups/${groupID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9a5f8fd3a72d7e78 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/groups/roles.ts:24 
    return this._client.post(path`/organization/groups/${groupID}/roles`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6105ee8c9b1a3526 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/groups/roles.ts:49 
    return this._client.get(path`/organization/groups/${group_id}/roles/${roleID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #90f8cdabd3688192 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/groups/users.ts:23 
    return this._client.post(path`/organization/groups/${groupID}/users`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8900b4059a92a156 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/groups/users.ts:48 
    return this._client.get(path`/organization/groups/${group_id}/users/${userID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #bf207eb8f95d6dd6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/invites.ts:47 
    return this._client.get(path`/organization/invites/${inviteID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d28e9f5275e36173 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/api-keys.ts:32 
    return this._client.get(path`/organization/projects/${project_id}/api_keys/${apiKeyID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #014f2109b08e3773 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/data-retention.ts:21 
    return this._client.get(path`/organization/projects/${projectID}/data_retention`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e46b7ab847150113 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/data-retention.ts:44 
    return this._client.post(path`/organization/projects/${projectID}/data_retention`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2a1357062440960f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/groups/groups.ts:38 
    return this._client.post(path`/organization/projects/${projectID}/groups`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c547677eccab0ffd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/groups/groups.ts:59 
    return this._client.get(path`/organization/projects/${project_id}/groups/${groupID}`, {
      query,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #442dd75c27fe2542 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/groups/roles.ts:29 
    return this._client.post(path`/projects/${project_id}/groups/${groupID}/roles`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #23db4ccb53bc45cd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/groups/roles.ts:54 
    return this._client.get(path`/projects/${project_id}/groups/${group_id}/roles/${roleID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #69f116a18fb8a091 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/hosted-tool-permissions.ts:21 
    return this._client.get(path`/organization/projects/${projectID}/hosted_tool_permissions`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a448211284880e52 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/hosted-tool-permissions.ts:43 
    return this._client.post(path`/organization/projects/${projectID}/hosted_tool_permissions`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cd06bd92f2729557 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/model-permissions.ts:21 
    return this._client.get(path`/organization/projects/${projectID}/model_permissions`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c1a48cdc56155a9f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/model-permissions.ts:44 
    return this._client.post(path`/organization/projects/${projectID}/model_permissions`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cf10f31ae2665641 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/projects.ts:165 
    return this._client.get(path`/organization/projects/${projectID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a03505e04328126e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/projects.ts:183 
    return this._client.post(path`/organization/projects/${projectID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #28c2386bd5824742 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/projects.ts:225 
    return this._client.post(path`/organization/projects/${projectID}/archive`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e1fa7cf3d39e8bc7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/rate-limits.ts:57 
    return this._client.post(path`/organization/projects/${project_id}/rate_limits/${rateLimitID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f090fc542f777e76 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/roles.ts:25 
    return this._client.post(path`/projects/${projectID}/roles`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #108412168f664dc6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/roles.ts:46 
    return this._client.get(path`/projects/${project_id}/roles/${roleID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6a0ff3101d38bac3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/roles.ts:66 
    return this._client.post(path`/projects/${project_id}/roles/${roleID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2212b45202c26cf7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/service-accounts/api-keys.ts:27 
    return this._client.post(
      path`/organization/projects/${project_id}/service_accounts/${serviceAccountID}/api_keys`,
      { body, ...options, __security: { adminAPIKeyAuth: true } },
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e4c10276f28afb33 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/service-accounts/service-accounts.ts:36 
    return this._client.post(path`/organization/projects/${projectID}/service_accounts`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #85c5134dc72cbe65 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/service-accounts/service-accounts.ts:61 
    return this._client.get(path`/organization/projects/${project_id}/service_accounts/${serviceAccountID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e417cababedfd803 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/service-accounts/service-accounts.ts:85 
    return this._client.post(
      path`/organization/projects/${project_id}/service_accounts/${serviceAccountID}`,
      { body, ...options, __security: { adminAPIKeyAuth: true } },
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e73de0c6eea0bd0f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/spend-alerts.ts:39 
    return this._client.post(path`/organization/projects/${projectID}/spend_alerts`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #db1a741b00b9c207 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/spend-alerts.ts:64 
    return this._client.get(path`/organization/projects/${project_id}/spend_alerts/${alertID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4e4c82fa7d2ec7f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/spend-alerts.ts:97 
    return this._client.post(path`/organization/projects/${project_id}/spend_alerts/${alertID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b72d845a691692a1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/roles.ts:26 
    return this._client.post(path`/projects/${project_id}/users/${userID}/roles`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e6c5d87ea3cf6921 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/roles.ts:51 
    return this._client.get(path`/projects/${project_id}/users/${user_id}/roles/${roleID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b8f37da212acec68 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/users.ts:43 
    return this._client.post(path`/organization/projects/${projectID}/users`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #a7c8e8ebe00fd1d8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/users.ts:64 
    return this._client.get(path`/organization/projects/${project_id}/users/${userID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ef66bb08595a5ea4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/projects/users/users.ts:84 
    return this._client.post(path`/organization/projects/${project_id}/users/${userID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b279a2a72670746e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/roles.ts:40 
    return this._client.get(path`/organization/roles/${roleID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #777a6fd4c6ec8fa4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/roles.ts:57 
    return this._client.post(path`/organization/roles/${roleID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #479a2f5352b41ba4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/spend-alerts.ts:51 
    return this._client.get(path`/organization/spend_alerts/${alertID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cdff3fb5af54fa85 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/spend-alerts.ts:82 
    return this._client.post(path`/organization/spend_alerts/${alertID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1d0a3692c46decd8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/users/roles.ts:25 
    return this._client.post(path`/organization/users/${userID}/roles`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #2572b7c6f3629e0a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/users/roles.ts:50 
    return this._client.get(path`/organization/users/${user_id}/roles/${roleID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6b9fe2bda102ae2e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/users/users.ts:39 
    return this._client.get(path`/organization/users/${userID}`, {
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b21e7d405b594c4e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/admin/organization/users/users.ts:55 
    return this._client.post(path`/organization/users/${userID}`, {
      body,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #84664859c5fe5265 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/batches.ts:26 
    return this._client.get(path`/batches/${batchID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c14b15ff4429efb6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/batches.ts:49 
    return this._client.post(path`/batches/${batchID}/cancel`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #deba6f6bd6a093c0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/assistants.ts:40 
    return this._client.get(path`/assistants/${assistantID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #781e98276095ce44 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/assistants.ts:53 
    return this._client.post(path`/assistants/${assistantID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0f9c3f5147911c93 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/chatkit/sessions.ts:44 
    return this._client.post(path`/chatkit/sessions/${sessionID}/cancel`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #037bd98664df998d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/chatkit/threads.ts:26 
    return this._client.get(path`/chatkit/threads/${threadID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'chatkit_beta=v1' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6d77c8312264af4f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/responses/responses.ts:95 
    return this._client.get(path`/responses/${responseID}?beta=true`, {
      query,
      ...options,
      headers: buildHeaders([
        { ...(betas?.toString() != null ? { 'openai-beta': betas?.toString() } : undefined) },
        options?.headers,
      ]),
      stream: params?.stream ?? false,
      __security: { bearerAuth: true },
    }) as APIPromise<BetaResponse> | APIPromise<Stream<BetaResponseStreamEvent>>;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ec438a1e2707ea67 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/responses/responses.ts:151 
    return this._client.post(path`/responses/${responseID}/cancel?beta=true`, {
      ...options,
      headers: buildHeaders([
        { ...(betas?.toString() != null ? { 'openai-beta': betas?.toString() } : undefined) },
        options?.headers,
      ]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #19e2d7b6da2fb011 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/messages.ts:24 
    return this._client.post(path`/threads/${threadID}/messages`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #98f8da63fe668abc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/messages.ts:39 
    return this._client.get(path`/threads/${thread_id}/messages/${messageID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e2b35975ffaa628f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/messages.ts:53 
    return this._client.post(path`/threads/${thread_id}/messages/${messageID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #967d8eb92b3f70e5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:74 
    return this._client.post(path`/threads/${threadID}/runs`, {
      query: { include },
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      stream: params.stream ?? false,
      __synthesizeEventData: true,
      __security: { bearerAuth: true },
    }) as APIPromise<Run> | APIPromise<Stream<AssistantsAPI.AssistantStreamEvent>>;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #13ed46e2b843e05d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:92 
    return this._client.get(path`/threads/${thread_id}/runs/${runID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e5949a18712cc44e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:106 
    return this._client.post(path`/threads/${thread_id}/runs/${runID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #659722dac903d697 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:139 
    return this._client.post(path`/threads/${thread_id}/runs/${runID}/cancel`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f9ca8658e94fed9d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/runs/runs.ts:265 
    return this._client.post(path`/threads/${thread_id}/runs/${runID}/submit_tool_outputs`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      stream: params.stream ?? false,
      __synthesizeEventData: true,
      __security: { bearerAuth: true },
    }) as APIPromise<Run> | APIPromise<Stream<AssistantsAPI.AssistantStreamEvent>>;

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #83aa1c4c34e26f91 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/runs/steps.ts:25 
    return this._client.get(path`/threads/${thread_id}/runs/${run_id}/steps/${stepID}`, {
      query,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #13ec3be4a20b6dea — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/threads.ts:104 
    return this._client.get(path`/threads/${threadID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #eaee51683c07bb61 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/beta/threads/threads.ts:117 
    return this._client.post(path`/threads/${threadID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f82823604138161a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/chat/completions/completions.ts:100 
    return this._client.get(path`/chat/completions/${completionID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ca6f365cdc556ef3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/chat/completions/completions.ts:124 
    return this._client.post(path`/chat/completions/${completionID}`, {
      body,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b67446a8b9cf5b61 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/containers/containers.ts:37 
    return this._client.get(path`/containers/${containerID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #43d765cb6bb09ef3 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/containers/files/content.ts:15 
    return this._client.get(path`/containers/${container_id}/files/${fileID}/content`, {
      ...options,
      headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
      __security: { bearerAuth: true },
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #eaa8dff38074ffe4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/containers/files/files.ts:28 
    return this._client.post(
      path`/containers/${containerID}/files`,
      maybeMultipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client),
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c20b45a3c5b6fb18 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/containers/files/files.ts:43 
    return this._client.get(path`/containers/${container_id}/files/${fileID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #b25cd9dd03f3f2bb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/conversations/conversations.ts:41 
    return this._client.get(path`/conversations/${conversationID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #956d6b6e82fc9ca0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/conversations/conversations.ts:55 
    return this._client.post(path`/conversations/${conversationID}`, {
      body,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #170527472baff445 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/conversations/items.ts:28 
    return this._client.post(path`/conversations/${conversationID}/items`, {
      query: { include },
      body,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5a5789c69423cc75 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/conversations/items.ts:45 
    return this._client.get(path`/conversations/${conversation_id}/items/${itemID}`, {
      query,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #bca444c3a05c6280 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/evals/evals.ts:52 
    return this._client.get(path`/evals/${evalID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #cbad8663590fc121 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/evals/evals.ts:59 
    return this._client.post(path`/evals/${evalID}`, { body, ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #657d0f410f4fcfb7 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/evals/runs/output-items.ts:23 
    return this._client.get(path`/evals/${eval_id}/runs/${run_id}/output_items/${outputItemID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #f2d1e128a63c5fc6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/evals/runs/runs.ts:34 
    return this._client.post(path`/evals/${evalID}/runs`, {
      body,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #6da2c654aacc1fbb — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/evals/runs/runs.ts:50 
    return this._client.get(path`/evals/${eval_id}/runs/${runID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress tooling Excluded from app score unknown #317709dd695dcc4a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/evals/runs/runs.ts:87 
    return this._client.post(path`/evals/${eval_id}/runs/${runID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #9fb978c5dade5aed — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/files.ts:58 
    return this._client.get(path`/files/${fileID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #abae2ae1d2f1eadd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/files.ts:86 
    return this._client.get(path`/files/${fileID}/content`, {
      ...options,
      headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
      __security: { bearerAuth: true },
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1e562d66520a1204 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/fine-tuning/checkpoints/permissions.ts:60 
    return this._client.get(path`/fine_tuning/checkpoints/${fineTunedModelCheckpoint}/permissions`, {
      query,
      ...options,
      __security: { adminAPIKeyAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1b545c9de704be54 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:58 
    return this._client.get(path`/fine_tuning/jobs/${fineTuningJobID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #855619a872b25ab8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:97 
    return this._client.post(path`/fine_tuning/jobs/${fineTuningJobID}/cancel`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #69c1a6eb0fd344a0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:139 
    return this._client.post(path`/fine_tuning/jobs/${fineTuningJobID}/pause`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #980f8a98ded9b2f6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/fine-tuning/jobs/jobs.ts:156 
    return this._client.post(path`/fine_tuning/jobs/${fineTuningJobID}/resume`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1c7db5f574587cdc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/models.ts:18 
    return this._client.get(path`/models/${model}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #41d9dfedceca829d — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/realtime/calls.ts:24 
    return this._client.post(path`/realtime/calls/${callID}/accept`, {
      body,
      ...options,
      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0caf59488a4b7cd6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/realtime/calls.ts:41 
    return this._client.post(path`/realtime/calls/${callID}/hangup`, {
      ...options,
      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fdaf9d9ce0601c65 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/realtime/calls.ts:59 
    return this._client.post(path`/realtime/calls/${callID}/refer`, {
      body,
      ...options,
      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ce2964968872c040 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/realtime/calls.ts:80 
    return this._client.post(path`/realtime/calls/${callID}/reject`, {
      body,
      ...options,
      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f100c0f83d3cf173 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/responses/responses.ts:158 
      this._client.get(path`/responses/${responseID}`, {
        query,
        ...options,
        stream: query?.stream ?? false,
        __security: { bearerAuth: true },
      }) as APIPromise<Response> | APIPromise<Stream<ResponseStreamEvent>>

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #94e8d25753415ecc — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/responses/responses.ts:223 
    return this._client.post(path`/responses/${responseID}/cancel`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7e22751e2a62aace — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/skills/content.ts:14 
    return this._client.get(path`/skills/${skillID}/content`, {
      ...options,
      headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
      __security: { bearerAuth: true },
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #cc307bcc2c415370 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/skills/skills.ts:43 
    return this._client.get(path`/skills/${skillID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d208e18a050c67c2 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/skills/skills.ts:50 
    return this._client.post(path`/skills/${skillID}`, {
      body,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #0b9aef579a4e65ff — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/skills/versions/content.ts:15 
    return this._client.get(path`/skills/${skill_id}/versions/${version}/content`, {
      ...options,
      headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
      __security: { bearerAuth: true },
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #3d311a4da3763e69 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/skills/versions/versions.ts:24 
    return this._client.post(
      path`/skills/${skillID}/versions`,
      maybeMultipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client),
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5b356671f1abf5e4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/skills/versions/versions.ts:39 
    return this._client.get(path`/skills/${skill_id}/versions/${version}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6896785ec51264f0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/uploads/parts.ts:28 
    return this._client.post(
      path`/uploads/${uploadID}/parts`,
      multipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client),
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #fcc6c77410175cc5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/uploads/uploads.ts:50 
    return this._client.post(path`/uploads/${uploadID}/cancel`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #5ac1dbd31814058f — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/uploads/uploads.ts:74 
    return this._client.post(path`/uploads/${uploadID}/complete`, {
      body,
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e0d49b91359df279 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/file-batches.ts:25 
    return this._client.post(path`/vector_stores/${vectorStoreID}/file_batches`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #90f8482bfa0c40d1 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/file-batches.ts:42 
    return this._client.get(path`/vector_stores/${vector_store_id}/file_batches/${batchID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #1b38c5a92ae762f5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/file-batches.ts:59 
    return this._client.post(path`/vector_stores/${vector_store_id}/file_batches/${batchID}/cancel`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #c9bd7f5e3317f00a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/files.ts:24 
    return this._client.post(path`/vector_stores/${vectorStoreID}/files`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #d1f544ffc1b292d5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/files.ts:41 
    return this._client.get(path`/vector_stores/${vector_store_id}/files/${fileID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ad849a22c35fd684 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/files.ts:53 
    return this._client.post(path`/vector_stores/${vector_store_id}/files/${fileID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ee86dc5dee68fca8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/vector-stores.ts:55 
    return this._client.get(path`/vector_stores/${vectorStoreID}`, {
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #8cddbe43de882221 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/vector-stores/vector-stores.ts:70 
    return this._client.post(path`/vector_stores/${vectorStoreID}`, {
      body,
      ...options,
      headers: buildHeaders([{ 'OpenAI-Beta': 'assistants=v2' }, options?.headers]),
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #ace120be0ed1fd8e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/videos.ts:27 
    return this._client.get(path`/videos/${videoID}`, { ...options, __security: { bearerAuth: true } });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #7c146f560874696a — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/videos.ts:74 
    return this._client.get(path`/videos/${videoID}/content`, {
      query,
      ...options,
      headers: buildHeaders([{ Accept: 'application/binary' }, options?.headers]),
      __security: { bearerAuth: true },
      __binaryResponse: true,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #75cb5b64c1644918 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/videos.ts:108 
    return this._client.get(path`/videos/characters/${characterID}`, {
      ...options,
      __security: { bearerAuth: true },
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #6349888a87bdaae0 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/resources/videos.ts:118 
    return this._client.post(
      path`/videos/${videoID}/remix`,
      maybeMultipartFormRequestOptions({ body, ...options, __security: { bearerAuth: true } }, this._client),
    );

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

ai

npm dependency
medium pii_flow dependency Excluded from app score #50c9c297d251a1ba — A credential read from the environment/filesystem is applied as authorization on the same outbound request (auth header). This is intentional authentication, not unexpected data exfiltration.
pkgs/npm/[email protected]/src/realtime/realtime-session.ts:110 · flow /tmp/closeopen-jglvjeb9/pkgs/npm/[email protected]/src/realtime/realtime-session.ts:110 → /tmp/closeopen-jglvjeb9/pkgs/npm/[email protected]/src/realtime/realtime-session.ts:110 
      const response = await fetch(this.api.token, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ sessionConfig: this.sessionConfig }),
      });

A credential read from the environment/filesystem is applied as authorization on the same outbound request (an auth header). This is intentional authentication to the service the credential belongs to, not unexpected data exfiltration.

Fix: Confirm the destination is the credential's own service; scope the credential and avoid logging it. No action if this is the intended authenticated API call.
expand_more 4 low-confidence finding(s)
low egress dependency Excluded from app score #0576a315974c36d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/realtime/realtime-session.ts:110 
      const response = await fetch(this.api.token, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ sessionConfig: this.sessionConfig }),
      });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #04c90b1ce50b8797 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/ui/call-completion-api.ts:57 
    const response = await fetch(api, {
      method: 'POST',
      body: JSON.stringify({
        prompt,
        ...body,
      }),
      credentials,
      headers: withUserAgentSuffix(
        {
          'Content-Type': 'application/json',
          ...headers,
        },
        `ai-sdk/${VERSION}`,
        getRuntimeEnvironmentUserAgent(),
      ),
      signal: abortController.signal,
    }).catch(err => {

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #21928bc3827fc0ce — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/ui/http-chat-transport.ts:191 
    const response = await fetch(api, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        ...headers,
      },
      body: JSON.stringify(body),
      credentials,
      signal: abortSignal,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #61ad4e15270143b8 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/src/ui/http-chat-transport.ts:246 
    const response = await fetch(api, {
      method: 'GET',
      headers,
      credentials,
    });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

@apidevtools/json-schema-ref-parser

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #50ec45ab53044b74 — Filesystem access.
pkgs/npm/@[email protected]/lib/resolvers/file.ts:39 
      return await fs.promises.readFile(path);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #c50ccb4445c22ca6 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/lib/resolvers/http.ts:137 
  const response = await fetch(u, {
    method: "GET",
    headers: httpOptions.headers || {},
    credentials: httpOptions.withCredentials ? "include" : "same-origin",
    redirect: "manual",
    signal: controller ? controller.signal : null,
  });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

@hookform/resolvers

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #39c4bb15f2e44a34 — Environment-variable access.
pkgs/npm/@[email protected]/yup/src/yup.ts:97 
      if (schemaOptions?.context && process.env.NODE_ENV === 'development') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@radix-ui/react-avatar

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs dependency Excluded from app score #4c223e684636103b — Environment-variable access.
pkgs/npm/@[email protected]__sourcemap/src/avatar.tsx:197 
  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #dddf66c7e5cc352e — Environment-variable access.
pkgs/npm/@[email protected]__sourcemap/src/avatar.tsx:215 
  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@radix-ui/react-context-menu

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #1eb13765eba5fca6 — Environment-variable access.
pkgs/npm/@[email protected]__sourcemap/src/context-menu.tsx:51 
  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@supabase/ssr

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #4bc88e961fbf0cd2 — Environment-variable access.
pkgs/npm/@[email protected]/src/warnDeprecatedPackage.ts:19 
  const packageName = process.env.npm_package_name;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@supabase/supabase-js

npm dependency
expand_more 2 low-confidence finding(s)
low egress dependency Excluded from app score #c50771c54a99e1d4 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/lib/fetch.ts:17 
  return (...args: Parameters<Fetch>) => fetch(...args)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #182e2fca7b32e549 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/lib/fetch.ts:113 
    return fetch(input, { ...init, headers })

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

@vercel/edge-config

npm dependency
expand_more 13 low-confidence finding(s)
low env_fs dependency Excluded from app score #0cc16d3c2012bb01 — Environment-variable access.
pkgs/npm/@[email protected]__sourcemap/src/create-create-client.ts:76 
      if (typeof process !== 'undefined' && process.env.VERCEL_ENV)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a9db02fefee2a1ef — Environment-variable access.
pkgs/npm/@[email protected]__sourcemap/src/create-create-client.ts:77 
        headers['x-edge-config-vercel-env'] = process.env.VERCEL_ENV;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ae07c742b592b124 — Environment-variable access.
pkgs/npm/@[email protected]__sourcemap/src/create-create-client.ts:93 
        process.env.NODE_ENV === 'development' &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bf62c30a0054f3b5 — Environment-variable access.
pkgs/npm/@[email protected]__sourcemap/src/create-create-client.ts:94 
        process.env.EDGE_CONFIG_DISABLE_DEVELOPMENT_SWR !== '1';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6621a3b4a1bf2d39 — Environment-variable access.
pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:59 
    if (!process.env.AWS_LAMBDA_FUNCTION_NAME) return null;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f385e83bd658a463 — Environment-variable access.
pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:148 
    if (typeof process !== 'undefined' && process.env.VERCEL_ENV)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #415af4f97650156a — Environment-variable access.
pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:149 
      headersRecord['x-edge-config-vercel-env'] = process.env.VERCEL_ENV;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #80f58e504641fa71 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__sourcemap/src/edge-config.ts:306 
  return fetch(`${baseUrl}/item/${key}?version=${version}`, {
    method: 'HEAD',
    headers,
    cache: fetchCache,
  }).then((res) => {

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #70bcc3e5aa699429 — Environment-variable access.
pkgs/npm/@[email protected]__sourcemap/src/index.ts:54 
    defaultEdgeConfigClient = createClient(process.env.EDGE_CONFIG);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #203eaaf59e3c4ac5 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__sourcemap/src/index.ts:70 
  return defaultEdgeConfigClient.get(...args);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f9e5c7e38636bb71 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__sourcemap/src/utils/fetch-with-cached-response.ts:119 
      const res: ResponseWithCachedResponse = await fetch(url, {
        ...customOptions,
        headers,
      }).then(

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #e4fa233c7d6f9f81 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]__sourcemap/src/utils/fetch-with-cached-response.ts:144 
    const res = await fetch(url, options);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #350d2136a2292e5b — Environment-variable access.
pkgs/npm/@[email protected]__sourcemap/src/utils/tracing.ts:53 
      process.env.EDGE_CONFIG_TRACE_VERBOSE === 'true' ||

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

@xenova/transformers

npm dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #b29759b3db3998dc — Filesystem access.
pkgs/npm/@[email protected]/src/env.js:25 
import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #eeb7fa708bb0233e — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/pipelines.js:2681 
                await (await fetch(speaker_embeddings)).arrayBuffer()

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #9596b10a7c013464 — Filesystem access.
pkgs/npm/@[email protected]/src/utils/hub.js:8 
import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f7313c5f3e5f3104 — Filesystem access.
pkgs/npm/@[email protected]/src/utils/hub.js:109 
        const data = await fs.promises.readFile(this.filePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3161518772ffe285 — Filesystem access.
pkgs/npm/@[email protected]/src/utils/hub.js:120 
        const data = await fs.promises.readFile(this.filePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #512a01342c88754f — Filesystem access.
pkgs/npm/@[email protected]/src/utils/hub.js:131 
        const data = await fs.promises.readFile(this.filePath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #37bccb4746bc208c — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/utils/hub.js:199 
        return fetch(urlOrPath, { headers });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #f3a71d4c1da0d0cd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/@[email protected]/src/utils/hub.js:204 
        return fetch(urlOrPath);

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low env_fs dependency Excluded from app score #e0dea0f28782afa4 — Filesystem access.
pkgs/npm/@[email protected]/src/utils/hub.js:280 
            await fs.promises.writeFile(outputPath, buffer);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

class-variance-authority

npm dependency
expand_more 3 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #e9ff278751e4f2de — Environment-variable access.
pkgs/npm/[email protected]__reposrc/docs/latest/theme.config.tsx:15 
  branch: process.env.NEXT_PUBLIC_VERCEL_GIT_COMMIT_REF || "main",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #31af2dea6c9a206e — Environment-variable access.
pkgs/npm/[email protected]__reposrc/docs/latest/theme.config.tsx:17 
    process.env.NEXT_PUBLIC_VERCEL_GIT_REPO_OWNER || "joe-bell",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d392b7702dd0f584 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/docs/latest/theme.config.tsx:18 
    process.env.NEXT_PUBLIC_VERCEL_GIT_REPO_SLUG || "cva",

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

d3-dsv

npm dependency
expand_more 12 low-confidence finding(s)
low env_fs dependency Excluded from app score #82190b6571a7c163 — Filesystem access.
pkgs/npm/[email protected]/bin/dsv2dsv.js:5 
import {readFileSync} from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #b88460faaa5783c8 — Filesystem access.
pkgs/npm/[email protected]/bin/dsv2dsv.js:17 
    .version(JSON.parse(readFileSync(resolve(dirname(fileURLToPath(import.meta.url)), "../package.json"))).version)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1789ace9f0746a8 — Filesystem access.
pkgs/npm/[email protected]/bin/dsv2dsv.js:30 
rw.dash.readFile(program.args[0] || "-", (error, text) => {
  if (error) throw error;
  rw.dash.writeFile("-", iconv.encode(outFormat.format(inFormat.parse(iconv.decode(text, options.inputEncoding))) + EOL, options.outputEncoding), (error) => {
    if (error) throw error;
  });
});

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #073689770859cd15 — Filesystem access.
pkgs/npm/[email protected]/bin/dsv2dsv.js:32 
  rw.dash.writeFile("-", iconv.encode(outFormat.format(inFormat.parse(iconv.decode(text, options.inputEncoding))) + EOL, options.outputEncoding), (error) => {
    if (error) throw error;
  });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #65e7eee596ac8797 — Filesystem access.
pkgs/npm/[email protected]/bin/dsv2json.js:5 
import {readFileSync} from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a175de6c53acf87 — Filesystem access.
pkgs/npm/[email protected]/bin/dsv2json.js:16 
    .version(JSON.parse(readFileSync(resolve(dirname(fileURLToPath(import.meta.url)), "../package.json"))).version)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c7f8eab439b1c86d — Filesystem access.
pkgs/npm/[email protected]/bin/dsv2json.js:29 
rw.dash.readFile(program.args[0] || "-", (error, text) => {
  if (error) throw error;
  const rowConverter = options.autoType ? dsv.autoType : null
  const rows = inFormat.parse(iconv.decode(text, options.inputEncoding), rowConverter);
  rw.dash.writeFile(options.out, iconv.encode(options.newlineDelimited
      ? rows.map((row) => JSON.stringify(row)).join("\n") + "\n"
      : JSON.stringify(rows) + EOL, options.outputEncoding), (error) => {
    if (error) throw error;
  });
});

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0f6da7c9e88d04e5 — Filesystem access.
pkgs/npm/[email protected]/bin/dsv2json.js:33 
  rw.dash.writeFile(options.out, iconv.encode(options.newlineDelimited
      ? rows.map((row) => JSON.stringify(row)).join("\n") + "\n"
      : JSON.stringify(rows) + EOL, options.outputEncoding), (error) => {
    if (error) throw error;
  });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #34970fa827f8bc1b — Filesystem access.
pkgs/npm/[email protected]/bin/json2dsv.js:5 
import {readFileSync} from "fs";

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #59a01cf45de6e63f — Filesystem access.
pkgs/npm/[email protected]/bin/json2dsv.js:16 
    .version(JSON.parse(readFileSync(resolve(dirname(fileURLToPath(import.meta.url)), "../package.json"))).version)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3570ce5ed2d04ebd — Filesystem access.
pkgs/npm/[email protected]/bin/json2dsv.js:28 
rw.dash.readFile(program.args[0] || "-", (error, text) => {
  if (error) throw error;
  text = iconv.decode(text, options.inputEncoding);
  rw.dash.writeFile(options.out, iconv.encode(outFormat.format(options.newlineDelimited
      ? text.trim().split(/\r?\n/g).map((line) => JSON.parse(line))
      : JSON.parse(text)) + EOL, options.outputEncoding), (error) => {
    if (error) throw error;
  });
});

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3db8169e794f2a2a — Filesystem access.
pkgs/npm/[email protected]/bin/json2dsv.js:31 
  rw.dash.writeFile(options.out, iconv.encode(outFormat.format(options.newlineDelimited
      ? text.trim().split(/\r?\n/g).map((line) => JSON.parse(line))
      : JSON.parse(text)) + EOL, options.outputEncoding), (error) => {
    if (error) throw error;
  });

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

gpt-tokenizer

npm dependency
expand_more 24 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #107425c4f5ec53ac — Filesystem access.
pkgs/npm/[email protected]/cjs/GptEncoding.test.js:39 
const fs_1 = __importDefault(require("fs"));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #1055846fad945632 — Filesystem access.
pkgs/npm/[email protected]/cjs/GptEncoding.test.js:418 
    const testPlanData = fs_1.default.readFileSync(testPlanPath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #2bb9922ddbf38fed — Filesystem access.
pkgs/npm/[email protected]/esm/GptEncoding.test.js:1 
import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #889219a6f5e3b744 — Filesystem access.
pkgs/npm/[email protected]/esm/GptEncoding.test.js:381 
    const testPlanData = fs.readFileSync(testPlanPath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #839a8d4020afcbc2 — Filesystem access.
pkgs/npm/[email protected]/esm/codegen/generateByModel.js:1 
import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c3c690f9bb05c71c — Filesystem access.
pkgs/npm/[email protected]/esm/codegen/generateByModel.js:35 
const template = await fs.readFile(path.join(__dirname, '../encoding/cl100k_base.ts'), 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d6f00fdddf93fc43 — Filesystem access.
pkgs/npm/[email protected]/esm/codegen/generateByModel.js:68 
    await fs.writeFile(path.join(__dirname, `../model/${modelName}.ts`), content);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1eecebea7503a99e — Filesystem access.
pkgs/npm/[email protected]/esm/codegen/generateChatEnabled.js:2 
import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cfc239b774fa7d67 — Filesystem access.
pkgs/npm/[email protected]/esm/codegen/generateChatEnabled.js:20 
await fs.writeFile(path.join(__dirname, '../modelsChatEnabled.gen.ts'), tsFileContent);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af8c08619fabbb9f — Filesystem access.
pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:2 
import * as fs from 'fs/promises';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9fc0ca3bec571b06 — Environment-variable access.
pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:5 
const DEBUG = process.env.DEBUG === 'true';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #6533c42fc30d67aa — Filesystem access.
pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:47 
    const bpeFile = await fs.readFile(filePath, 'utf8');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86e7954430f283b6 — Filesystem access.
pkgs/npm/[email protected]/esm/codegen/generateJsBpe.js:105 
    await fs.writeFile(path.join(__dirname, `../bpeRanks/${modelName}.js`), `${preamble}
${jsCodeConstsForEachChunk.join('\n')}
/** @type {(string | number[])[]} */
const bpe = ${jsCodeBpeArray};
${jsCodeToResetHelperArrays.join('\n')}
export default bpe;`);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5d7f94de85f3dd86 — Filesystem access.
pkgs/npm/[email protected]/src/GptEncoding.test.ts:1 
import fs from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #a3d861c42e06d4ca — Filesystem access.
pkgs/npm/[email protected]/src/GptEncoding.test.ts:500 
  const testPlanData = fs.readFileSync(testPlanPath, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c48e967fefd322c3 — Filesystem access.
pkgs/npm/[email protected]/src/codegen/generateByModel.ts:1 
import * as fs from 'fs/promises'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aaf0020319a786b5 — Filesystem access.
pkgs/npm/[email protected]/src/codegen/generateByModel.ts:55 
const template = await fs.readFile(
  path.join(__dirname, '../encoding/cl100k_base.ts'),
  'utf8',
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3e5fc356a27f07fc — Filesystem access.
pkgs/npm/[email protected]/src/codegen/generateByModel.ts:111 
    await fs.writeFile(
      path.join(__dirname, `../model/${modelName}.ts`),
      content,
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #855a0bd52c69a58e — Filesystem access.
pkgs/npm/[email protected]/src/codegen/generateChatEnabled.ts:2 
import * as fs from 'fs/promises'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #bfc21d0edbfeb66f — Filesystem access.
pkgs/npm/[email protected]/src/codegen/generateChatEnabled.ts:31 
await fs.writeFile(
  path.join(__dirname, '../modelsChatEnabled.gen.ts'),
  tsFileContent,
)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9f1929d90b535493 — Filesystem access.
pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:2 
import * as fs from 'fs/promises'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3925be9e745f5fd1 — Environment-variable access.
pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:7 
const DEBUG = process.env.DEBUG === 'true'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1201f95272ad119c — Filesystem access.
pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:57 
    const bpeFile = await fs.readFile(filePath, 'utf8')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96a377802a566e61 — Filesystem access.
pkgs/npm/[email protected]/src/codegen/generateJsBpe.ts:138 
    await fs.writeFile(
      path.join(__dirname, `../bpeRanks/${modelName}.js`),
      `${preamble}
${jsCodeConstsForEachChunk.join('\n')}
/** @type {(string | number[])[]} */
const bpe = ${jsCodeBpeArray};
${jsCodeToResetHelperArrays.join('\n')}
export default bpe;`,
    )

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

i18next-resources-to-backend

npm dependency
expand_more 2 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #db7fbf78c8a3ef21 — Filesystem access.
pkgs/npm/[email protected]/rollup.config.js:5 
import { readFileSync } from 'fs'

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ac8e4119fd510035 — Filesystem access.
pkgs/npm/[email protected]/rollup.config.js:6 
const pkg = JSON.parse(readFileSync(new URL('package.json', import.meta.url)))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

mammoth

npm dependency
expand_more 3 low-confidence finding(s)
low env_fs dependency Excluded from app score #3ab3f4e8ea3575ae — Filesystem access.
pkgs/npm/[email protected]/lib/docx/files.js:1 
var fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f2d0bda56d51a7a3 — Filesystem access.
pkgs/npm/[email protected]/lib/main.js:3 
var fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4a89ff8cf7fe3d9e — Filesystem access.
pkgs/npm/[email protected]/lib/unzip.js:1 
var fs = require("fs");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

next-pwa

npm dependency
expand_more 18 low-confidence finding(s)
low env_fs dependency Excluded from app score #786d3c1cb3aee311 — Filesystem access.
pkgs/npm/[email protected]/build-custom-worker.js:4 
const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #674b65b6f9e6f084 — Filesystem access.
pkgs/npm/[email protected]/build-fallback-worker.js:4 
const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #48ea295d017344d3 — Environment-variable access.
pkgs/npm/[email protected]/fallback.js:7 
      if (process.env.__PWA_FALLBACK_DOCUMENT__)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #224282de87e55e74 — Environment-variable access.
pkgs/npm/[email protected]/fallback.js:8 
        return caches.match(process.env.__PWA_FALLBACK_DOCUMENT__, { ignoreSearch: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d0d40adf471ccd43 — Environment-variable access.
pkgs/npm/[email protected]/fallback.js:10 
      if (process.env.__PWA_FALLBACK_IMAGE__)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4abf95d6faa8efc8 — Environment-variable access.
pkgs/npm/[email protected]/fallback.js:11 
        return caches.match(process.env.__PWA_FALLBACK_IMAGE__, { ignoreSearch: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0bca796c37666e4e — Environment-variable access.
pkgs/npm/[email protected]/fallback.js:13 
      if (process.env.__PWA_FALLBACK_AUDIO__)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c470182540756ae1 — Environment-variable access.
pkgs/npm/[email protected]/fallback.js:14 
        return caches.match(process.env.__PWA_FALLBACK_AUDIO__, { ignoreSearch: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #180083c56a15a154 — Environment-variable access.
pkgs/npm/[email protected]/fallback.js:16 
      if (process.env.__PWA_FALLBACK_VIDEO__)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f4ceebdccfb04f64 — Environment-variable access.
pkgs/npm/[email protected]/fallback.js:17 
        return caches.match(process.env.__PWA_FALLBACK_VIDEO__, { ignoreSearch: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4847660ec1d3b728 — Environment-variable access.
pkgs/npm/[email protected]/fallback.js:19 
      if (process.env.__PWA_FALLBACK_FONT__)

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #053f84afc2163387 — Environment-variable access.
pkgs/npm/[email protected]/fallback.js:20 
        return caches.match(process.env.__PWA_FALLBACK_FONT__, { ignoreSearch: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #af6ee9c761b2ab7e — Environment-variable access.
pkgs/npm/[email protected]/fallback.js:22 
      if (process.env.__PWA_FALLBACK_DATA__ && request.url.match(/\/_next\/data\/.+\/.+\.json$/i))

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #be7a8c04acb8c20c — Environment-variable access.
pkgs/npm/[email protected]/fallback.js:23 
        return caches.match(process.env.__PWA_FALLBACK_DATA__, { ignoreSearch: true })

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #21c473bda78593b8 — Filesystem access.
pkgs/npm/[email protected]/index.js:4 
const fs = require('fs')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #ee51f3438f3f8c2b — Filesystem access.
pkgs/npm/[email protected]/index.js:13 
const getRevision = file => crypto.createHash('md5').update(fs.readFileSync(file)).digest('hex')

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #535bc1b65da7aecd — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/register.js:18 
        const response = await fetch(__PWA_START_URL__)

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.
low egress dependency Excluded from app score #4c92231a71e2e915 — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]/register.js:53 
        return fetch(__PWA_START_URL__).then(function (response) {

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

next-themes

npm dependency
expand_more 4 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #0b8e9be0cb7722aa — Environment-variable access.
pkgs/npm/[email protected]__reposrc/playwright.config.ts:4 
  forbidOnly: !!process.env.CI,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e65f52aa54c00f70 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/playwright.config.ts:5 
  retries: process.env.CI ? 2 : 0,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #79e12c22a0883150 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/playwright.config.ts:6 
  reporter: process.env.CI ? 'github' : 'list',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #4f6ee960073546fe — Environment-variable access.
pkgs/npm/[email protected]__reposrc/playwright.config.ts:11 
    reuseExistingServer: !process.env.CI,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

pdf-parse

npm dependency
expand_more 9 low-confidence finding(s)
low env_fs dependency Excluded from app score #b9e7513cb1f2d05a — Filesystem access.
pkgs/npm/[email protected]/bin/cli.mjs:27 
	const pkg = JSON.parse(await readFile(new URL('../package.json', import.meta.url)));

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #182cf317922a1beb — Filesystem access.
pkgs/npm/[email protected]/bin/cli.mjs:103 
		const data = await readFile(filePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #81063bd994d1a28e — Filesystem access.
pkgs/npm/[email protected]/bin/cli.mjs:156 
		await writeFile(options.output, output);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #912c07e909bb5af2 — Filesystem access.
pkgs/npm/[email protected]/bin/cli.mjs:167 
		await writeFile(options.output, output);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a787eebbef6fe763 — Filesystem access.
pkgs/npm/[email protected]/bin/cli.mjs:179 
		await writeFile(options.output, output);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cdf3ab4b9cccda65 — Filesystem access.
pkgs/npm/[email protected]/bin/cli.mjs:208 
				await writeFile(filepath, image.data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #1e034e9dedb94fb2 — Filesystem access.
pkgs/npm/[email protected]/bin/cli.mjs:278 
			await writeFile(filepath, page.data);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #07edcea0694a7887 — Filesystem access.
pkgs/npm/[email protected]/bin/cli.test.mjs:59 
	await fs.writeFile(dummyFile, 'dummy content');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d427015ef63c1c01 — Filesystem access.
pkgs/npm/[email protected]/bin/cli.test.mjs:90 
	await fs.writeFile(dummyFile, 'dummy content');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

react

npm dependency
expand_more 14 low-confidence finding(s)
low env_fs dependency Excluded from app score #90bef8de15c8cc38 — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-compiler-runtime.development.js:12 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #0965f933b0584525 — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-jsx-dev-runtime.development.js:12 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e3f5ab3e756071a3 — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-jsx-dev-runtime.react-server.development.js:12 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e223f65d24345041 — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-jsx-runtime.development.js:12 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a899305958bf3a94 — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-jsx-runtime.react-server.development.js:12 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e6f17fdaeec073ef — Environment-variable access.
pkgs/npm/[email protected]/cjs/react.development.js:12 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #155a0bd576bcfe7d — Environment-variable access.
pkgs/npm/[email protected]/cjs/react.react-server.development.js:12 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c6f3b4eb2cfcb001 — Environment-variable access.
pkgs/npm/[email protected]/compiler-runtime.js:10 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #e08c7a9961cc3655 — Environment-variable access.
pkgs/npm/[email protected]/index.js:3 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8aba99feedf98644 — Environment-variable access.
pkgs/npm/[email protected]/jsx-dev-runtime.js:3 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d1254544168b71a0 — Environment-variable access.
pkgs/npm/[email protected]/jsx-dev-runtime.react-server.js:3 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4b220ad8ffac0f6f — Environment-variable access.
pkgs/npm/[email protected]/jsx-runtime.js:3 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #a86ede901ad07559 — Environment-variable access.
pkgs/npm/[email protected]/jsx-runtime.react-server.js:3 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9caf4280eae29d82 — Environment-variable access.
pkgs/npm/[email protected]/react.react-server.js:3 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

react-dom

npm dependency
expand_more 24 low-confidence finding(s)
low env_fs dependency Excluded from app score #17d25dd933e43ef3 — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-dom-profiling.development.js:15 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #96bc9a542b24aa73 — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-dom-server-legacy.browser.development.js:36 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #8654df398d7d86e1 — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-dom-server-legacy.node.development.js:36 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f8a0890aa25f8704 — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-dom-server.browser.development.js:36 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9d358e89f78b0b1f — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-dom-server.edge.development.js:36 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #25daff406b2b7ea9 — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-dom-server.node.development.js:12 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #45f5f2ce0a457861 — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-dom-test-utils.development.js:12 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #86e24803f7b660c9 — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-dom.development.js:12 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #d507cc642233f0f8 — Environment-variable access.
pkgs/npm/[email protected]/cjs/react-dom.react-server.development.js:12 
"production" !== process.env.NODE_ENV &&

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f43a79349b52f0f7 — Environment-variable access.
pkgs/npm/[email protected]/client.js:11 
  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #f8402a28361f3bae — Environment-variable access.
pkgs/npm/[email protected]/client.js:31 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #93ba372776a8472c — Environment-variable access.
pkgs/npm/[email protected]/index.js:11 
  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #aa4aaa76b3b034ca — Environment-variable access.
pkgs/npm/[email protected]/index.js:31 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #520251583d24001b — Environment-variable access.
pkgs/npm/[email protected]/profiling.js:11 
  if (process.env.NODE_ENV !== 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #3300f2a6ceb941ee — Environment-variable access.
pkgs/npm/[email protected]/profiling.js:31 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #fdb81e2292412e5a — Environment-variable access.
pkgs/npm/[email protected]/react-dom.react-server.js:3 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #26586720739b55d2 — Environment-variable access.
pkgs/npm/[email protected]/server.browser.js:4 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #77d505a7d236d0a6 — Environment-variable access.
pkgs/npm/[email protected]/server.bun.js:5 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #9fe789c973d3e48d — Environment-variable access.
pkgs/npm/[email protected]/server.edge.js:5 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #54e4b83f06aa1548 — Environment-variable access.
pkgs/npm/[email protected]/server.node.js:4 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #df9a36dac3b6926a — Environment-variable access.
pkgs/npm/[email protected]/static.browser.js:4 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #cdb48002e4b76500 — Environment-variable access.
pkgs/npm/[email protected]/static.edge.js:4 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #c642a9167f9f36a6 — Environment-variable access.
pkgs/npm/[email protected]/static.node.js:4 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs dependency Excluded from app score #4bab78639af95964 — Environment-variable access.
pkgs/npm/[email protected]/test-utils.js:3 
if (process.env.NODE_ENV === 'production') {

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

react-hook-form

npm dependency
expand_more 12 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #1c838e509a9e7178 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/playwright.config.ts:6 
  retries: process.env.CI ? 2 : 0,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #0e44a8dc9125dd49 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/playwright.config.ts:7 
  reporter: process.env.CI ? [['github'], ['html', { open: 'never' }]] : 'list',

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #23c06e150cc86857 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/playwright.config.ts:15 
    reuseExistingServer: !process.env.CI,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e5888ddb353d68de — Filesystem access.
pkgs/npm/[email protected]__reposrc/scripts/apiExtractor.js:3 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #14d1547fd7ccc0b4 — Filesystem access.
pkgs/npm/[email protected]__reposrc/scripts/apiExtractor.js:64 
  const report = fs.readFileSync(config.reportFilePath);

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b94110535be9f6e0 — Filesystem access.
pkgs/npm/[email protected]__reposrc/scripts/bench-compare.ts:10 
import { copyFileSync, existsSync, mkdirSync, unlinkSync } from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #302ed07c07388ce4 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/scripts/jest/jest.config.js:44 
  const testEnv = process.env.TEST_ENV;

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e511243c96e495e1 — Filesystem access.
pkgs/npm/[email protected]__reposrc/scripts/rollup/assert-cjs-exports.cjs:9 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #51090f537bda69db — Filesystem access.
pkgs/npm/[email protected]__reposrc/scripts/rollup/assert-cjs-exports.cjs:15 
  fs.readFileSync(
    require('path').resolve(__dirname, './all-exports.json'),
    'utf-8',
  ),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #81c002ed390866c4 — Filesystem access.
pkgs/npm/[email protected]__reposrc/scripts/rollup/assert-esm-exports.mjs:9 
import fs from 'fs';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #cdae94fb370b0c17 — Filesystem access.
pkgs/npm/[email protected]__reposrc/scripts/rollup/assert-esm-exports.mjs:20 
  fs.readFileSync(path.resolve(__dirname, './all-exports.json'), 'utf-8'),

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low egress dependency Excluded from app score #f8390bad46bb1cab — Outbound request to a variable or assembled URL on a network client. Review what data is sent to this destination.
pkgs/npm/[email protected]__reposrc/src/form.tsx:88 
            const response = await fetch(String(action), {
              method,
              headers: {
                ...headers,
                ...(encType && encType !== 'multipart/form-data'
                  ? { 'Content-Type': encType }
                  : {}),
              },
              body: shouldStringifySubmissionData ? formDataJson : formData,
            });

Data is sent to a hardcoded external endpoint; review what leaves the process.

Fix: Verify the destination and that only non-sensitive data is sent; pin and audit the dependency.

react-i18next

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #e75897d9430324bf — Environment-variable access.
pkgs/npm/[email protected]/src/useTranslation.js:221 
      inDevelopment = process.env.NODE_ENV !== 'production';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

react-syntax-highlighter

npm dependency
expand_more 24 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #f9263258074b751f — Filesystem access.
pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:6 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #0e39d7a13687cc0d — Filesystem access.
pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:34 
  fs.writeFile(
    path.join(__dirname, `../src/async-languages/hljs.js`),
    lines.join('\n'),
    err => {
      if (err) {
        throw err;
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #2dc95ad3e8b597fa — Filesystem access.
pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:50 
  fs.writeFile(
    path.join(__dirname, `../src/languages/hljs/supported-languages.js`),
    lines.join(''),
    err => {
      if (err) {
        throw err;
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #81e9678716aa9ead — Filesystem access.
pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:70 
  fs.writeFile(
    path.join(__dirname, `../src/languages/hljs/${file}`),
    lines.join(';\n'),
    err => {
      if (err) {
        throw err;
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d7866382a9fc4b0b — Filesystem access.
pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:103 
    fs.writeFile(
      path.join(__dirname, '../AVAILABLE_LANGUAGES_HLJS.MD'),
      languageMD,
      err => {
        if (err) {
          throw err;
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5e12fea9c332bb3a — Filesystem access.
pkgs/npm/[email protected]/scripts/build-languages-highlightjs.js:117 
    fs.writeFile(
      path.join(__dirname, '../src/languages/hljs/index.js'),
      defaultExports.join(''),
      err => {
        if (err) {
          throw err;
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #75433f29afa03539 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-languages-refractor.js:6 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5155dc50e6ca1303 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-languages-refractor.js:30 
  fs.writeFile(
    path.join(__dirname, `../src/languages/prism/${file}`),
    lines.join(';\n'),
    err => {
      if (err) {
        process.exit(1);
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d4e7c59cb971f889 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-languages-refractor.js:53 
  fs.writeFile(
    path.join(__dirname, `../src/languages/prism/supported-languages.js`),
    lines.join(''),
    err => {
      if (err) {
        throw err;
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b11e08ee9d655952 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-languages-refractor.js:73 
  fs.writeFile(
    path.join(__dirname, `../src/async-languages/prism.js`),
    lines.join('\n'),
    err => {
      if (err) {
        throw err;
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #dba0e5e591a5ec2c — Filesystem access.
pkgs/npm/[email protected]/scripts/build-languages-refractor.js:108 
    fs.writeFile(
      path.join(__dirname, '../AVAILABLE_LANGUAGES_PRISM.MD'),
      languageMD,
      err => {
        if (err) {
          process.exit(1);
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #6852d9601caaf424 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-languages-refractor.js:122 
    fs.writeFile(
      path.join(__dirname, '../src/languages/prism/index.js'),
      defaultExports.join(''),
      err => {
        if (err) {
          process.exit(1);
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #e36a6e9a46d6e9c6 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:6 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #428ec84e0db53b20 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:35 
    fs.writeFile(
      path.join(__dirname, '../AVAILABLE_STYLES_HLJS.MD'),
      styleMD,
      err => {
        if (err) {
          throw err;
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d834927a47aa6fa7 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:44 
    fs.writeFile(
      path.join(__dirname, '../src/styles/hljs/index.js'),
      defaultExports.join(''),
      err => {
        if (err) {
          throw err;
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #3b41ef9c8e8fbcb3 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:57 
    fs.writeFile(
      path.join(__dirname, '../demo/styles/hljs.js'),
      demoStylesArray,
      err => {
        if (err) {
          throw err;
        }
      }
    );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5ba0bb283e349090 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:75 
  fs.readFile(
    path.join(__dirname, `../node_modules/highlight.js/styles/${file}`),
    'utf-8',
    (err, data) => {
      if (err) {
        throw err;
      }
      const javacriptStylesheet = css
        .parse(data)
        .stylesheet.rules.reduce((sheet, rule) => {
          if (rule.type === 'rule') {
            const style = rule.selectors.reduce((selectors, selector) => {
              if (!selector.includes(ignoreStyleWithThis)) {
                const selectorObject = rule.declarations.reduce(
                  (declarations, declaration) => {
                    if (
                      declaration.type === 'declaration' &&
                      declaration.property
                    ) {
                      declarations[camel(declaration.property)] =
                        declaration.value;
                    }
                    return declarations;
                  },
                  {}
                );
                selectors[selector.substring(1)] = selectorObject;
              }
              return selectors;
            }, {});
            sheet = Object.keys(style).reduce((stylesheet, selector) => {
              if (stylesheet[selector]) {
                stylesheet[selector] = Object.assign(
                  {},
                  stylesheet[selector],
                  style[selector]
                );
              } else {
                stylesheet[selector] = style[selector];
              }
              return stylesheet;
            }, sheet);
          }
          return sheet;
        }, {});
      fs.writeFile(
        path.join(__dirname, `../src/styles/hljs/${fileWithoutCSS}.js`),
        `export default ${JSON.stringify(javacriptStylesheet, null, 4)}`,
        err => {
          if (err) {
            throw err;
          }
        }
      );
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5d43070866272254 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-stylesheets-highlightjs.js:120 
      fs.writeFile(
        path.join(__dirname, `../src/styles/hljs/${fileWithoutCSS}.js`),
        `export default ${JSON.stringify(javacriptStylesheet, null, 4)}`,
        err => {
          if (err) {
            throw err;
          }
        }
      );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #c8520e31dbab615f — Filesystem access.
pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:3 
const fs = require('fs');

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #ad82e846d149d6a6 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:53 
  fs.writeFile(
    path.join(__dirname, '../AVAILABLE_STYLES_PRISM.MD'),
    styleMD,
    () => {}
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #664f09c5c1e5f50f — Filesystem access.
pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:58 
  fs.writeFile(
    path.join(__dirname, '../src/styles/prism/index.js'),
    defaultExports.join(''),
    () => {}
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #d35e7e3f47cc7456 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:67 
  fs.writeFile(
    path.join(__dirname, '../demo/styles/prism.js'),
    demoStylesArray,
    err => {
      if (err) {
        throw err;
      }
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #102635331966cdf2 — Filesystem access.
pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:82 
  fs.readFile(
    path.join(__dirname, `${directory}/${file}`),
    'utf-8',
    (err, data) => {
      const javacriptStylesheet = css
        .parse(data)
        .stylesheet.rules.reduce((sheet, rule) => {
          if (rule.type === 'rule') {
            const style = rule.selectors.reduce((selectors, selector) => {
              const selectorObject = rule.declarations.reduce(
                (declarations, declaration) => {
                  if (
                    declaration.type === 'declaration' &&
                    declaration.property
                  ) {
                    const camelCaseDeclarationProp = camel(
                      declaration.property
                    );
                    const key =
                      camelCaseDeclarationProp.includes('moz') ||
                      camelCaseDeclarationProp.includes('webkit') ||
                      (camelCaseDeclarationProp[0] === 'o' &&
                        !camelCaseDeclarationProp.includes('overflow'))
                        ? `${camelCaseDeclarationProp
                            .substring(0, 1)
                            .toUpperCase()}${camelCaseDeclarationProp.substring(
                            1
                          )}`
                        : camelCaseDeclarationProp;
                    declarations[key] = declaration.value;
                  }
                  return declarations;
                },
                {}
              );

              if (selector.substring(0, 6) === '.token') {
                selector = selector.substring(7);

                // Regex to fix Prism theme selectors
                // - Remove further `.token` classes
                // - Remove the space (descendant combinator)
                //   to allow for styling multiple classes
                //   Ref: https://github.com/react-syntax-highlighter/react-syntax-highlighter/pull/305
                selector = selector.replace(/(?<=\w) (\.token)?(?=\.)/g, '');
              }
              selectors[selector] = selectorObject;
              return selectors;
            }, {});
            sheet = Object.keys(style).reduce((stylesheet, selector) => {
              if (stylesheet[selector]) {
                stylesheet[selector] = Object.assign(
                  {},
                  stylesheet[selector],
                  style[selector]
                );
              } else {
                stylesheet[selector] = style[selector];
              }
              return stylesheet;
            }, sheet);
          }
          return sheet;
        }, {});
      fs.writeFile(
        path.join(__dirname, `../src/styles/prism/${fileWithoutCSS}.js`),
        `export default ${JSON.stringify(javacriptStylesheet, null, 4)}`,
        () => {}
      );
    }
  );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #62186bcdedb5841f — Filesystem access.
pkgs/npm/[email protected]/scripts/build-stylesheets-refractor.js:146 
      fs.writeFile(
        path.join(__dirname, `../src/styles/prism/${fileWithoutCSS}.js`),
        `export default ${JSON.stringify(javacriptStylesheet, null, 4)}`,
        () => {}
      );

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

react-textarea-autosize

npm dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #799df509a90743ed — Environment-variable access.
pkgs/npm/[email protected]__reposrc/.babelrc.js:1 
const test = process.env.NODE_ENV === 'test';

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

sonner

npm dependency
expand_more 4 low-confidence finding(s)
low env_fs tooling Excluded from app score unknown #da93f98b0276ff72 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/playwright.config.ts:26 
  forbidOnly: !!process.env.CI,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #407fd31ef8d1ab0e — Environment-variable access.
pkgs/npm/[email protected]__reposrc/playwright.config.ts:28 
  retries: process.env.CI ? 2 : 0,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #5f24f4eaaddc4ade — Environment-variable access.
pkgs/npm/[email protected]__reposrc/playwright.config.ts:30 
  workers: process.env.CI ? 1 : undefined,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.
low env_fs tooling Excluded from app score unknown #b0ee08135c012db7 — Environment-variable access.
pkgs/npm/[email protected]__reposrc/playwright.config.ts:42 
    reuseExistingServer: !process.env.CI,

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • next prod — tarball exceeds byte cap